Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2021-41091 (GCVE-0-2021-41091)
Vulnerability from cvelistv5 – Published: 2021-10-04 20:20 – Updated: 2024-08-04 02:59
VLAI?
EPSS
Title
Insufficiently restricted permissions on data directory in Docker Engine
Summary
Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.
Severity ?
6.3 (Medium)
CWE
- CWE-281 - Improper Preservation of Permissions
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/moby/moby/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/moby/moby/commit/f0ab919f518c4… | x_refsource_MISC |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://cert-portal.siemens.com/productcert/pdf/s… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:59:31.575Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64"
},
{
"name": "FEDORA-2021-df975338d4",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/"
},
{
"name": "FEDORA-2021-b5a9a481a2",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "moby",
"vendor": "moby",
"versions": [
{
"status": "affected",
"version": "\u003c 20.10.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-281",
"description": "CWE-281: Improper Preservation of Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-14T10:06:37.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64"
},
{
"name": "FEDORA-2021-df975338d4",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/"
},
{
"name": "FEDORA-2021-b5a9a481a2",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
}
],
"source": {
"advisory": "GHSA-3fwx-pjgw-3558",
"discovery": "UNKNOWN"
},
"title": "Insufficiently restricted permissions on data directory in Docker Engine",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-41091",
"STATE": "PUBLIC",
"TITLE": "Insufficiently restricted permissions on data directory in Docker Engine"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "moby",
"version": {
"version_data": [
{
"version_value": "\u003c 20.10.9"
}
]
}
}
]
},
"vendor_name": "moby"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-281: Improper Preservation of Permissions"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558",
"refsource": "CONFIRM",
"url": "https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558"
},
{
"name": "https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64",
"refsource": "MISC",
"url": "https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64"
},
{
"name": "FEDORA-2021-df975338d4",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/"
},
{
"name": "FEDORA-2021-b5a9a481a2",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
}
]
},
"source": {
"advisory": "GHSA-3fwx-pjgw-3558",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-41091",
"datePublished": "2021-10-04T20:20:09.000Z",
"dateReserved": "2021-09-15T00:00:00.000Z",
"dateUpdated": "2024-08-04T02:59:31.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2021-41091",
"date": "2026-05-19",
"epss": "0.04746",
"percentile": "0.89536"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"20.10.9\", \"matchCriteriaId\": \"83825875-76D7-4BB9-BB49-86568EBE67E9\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A930E247-0B43-43CB-98FF-6CE7B8189835\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"80E516C0-98A4-4ADE-B69F-66A772E2BAAA\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.\"}, {\"lang\": \"es\", \"value\": \"Moby es un proyecto de c\\u00f3digo abierto creado por Docker para permitir la contenci\\u00f3n de software. Se encontr\\u00f3 un error en Moby (Docker Engine) en el que el directorio de datos (normalmente \\\"/var/lib/docker\\\") conten\\u00eda subdirectorios con permisos insuficientemente restringidos, lo que permit\\u00eda a usuarios de Linux no privilegiados saltar el contenido del directorio y ejecutar programas. Cuando los contenedores inclu\\u00edan programas ejecutables con bits de permiso extendidos (como \\\"setuid\\\"), los usuarios no privilegiados de Linux pod\\u00edan detectar y ejecutar esos programas. Cuando el UID de un usuario de Linux no privilegiados en el host colisionaba con el propietario o el grupo de un archivo dentro de un contenedor, el usuario de Linux no privilegiados en el host pod\\u00eda descubrir, leer y modificar esos archivos. Este bug ha sido corregido en Moby (Docker Engine) versi\\u00f3n 20.10.9. Usuarios deber\\u00edan actualizar a esta versi\\u00f3n lo antes posible. Los contenedores en ejecuci\\u00f3n deben ser detenidos y reiniciados para que los permisos sean corregidos. Para usuarios que no puedan actualizar, limite el acceso al host a usuarios confiables. Limite el acceso a los vol\\u00famenes del host a los contenedores confiables\"}]",
"id": "CVE-2021-41091",
"lastModified": "2024-11-21T06:25:26.587",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L\", \"baseScore\": 6.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.0, \"impactScore\": 3.7}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L\", \"baseScore\": 6.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.0, \"impactScore\": 3.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 4.6, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 3.9, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2021-10-04T21:15:12.680",
"references": "[{\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-281\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-732\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-41091\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2021-10-04T21:15:12.680\",\"lastModified\":\"2024-11-21T06:25:26.587\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.\"},{\"lang\":\"es\",\"value\":\"Moby es un proyecto de c\u00f3digo abierto creado por Docker para permitir la contenci\u00f3n de software. Se encontr\u00f3 un error en Moby (Docker Engine) en el que el directorio de datos (normalmente \\\"/var/lib/docker\\\") conten\u00eda subdirectorios con permisos insuficientemente restringidos, lo que permit\u00eda a usuarios de Linux no privilegiados saltar el contenido del directorio y ejecutar programas. Cuando los contenedores inclu\u00edan programas ejecutables con bits de permiso extendidos (como \\\"setuid\\\"), los usuarios no privilegiados de Linux pod\u00edan detectar y ejecutar esos programas. Cuando el UID de un usuario de Linux no privilegiados en el host colisionaba con el propietario o el grupo de un archivo dentro de un contenedor, el usuario de Linux no privilegiados en el host pod\u00eda descubrir, leer y modificar esos archivos. Este bug ha sido corregido en Moby (Docker Engine) versi\u00f3n 20.10.9. Usuarios deber\u00edan actualizar a esta versi\u00f3n lo antes posible. Los contenedores en ejecuci\u00f3n deben ser detenidos y reiniciados para que los permisos sean corregidos. Para usuarios que no puedan actualizar, limite el acceso al host a usuarios confiables. Limite el acceso a los vol\u00famenes del host a los contenedores confiables\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.0,\"impactScore\":3.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.0,\"impactScore\":3.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-281\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"20.10.9\",\"matchCriteriaId\":\"83825875-76D7-4BB9-BB49-86568EBE67E9\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A930E247-0B43-43CB-98FF-6CE7B8189835\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80E516C0-98A4-4ADE-B69F-66A772E2BAAA\"}]}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
CERTFR-2022-AVI-547
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | Teamcenter Active Workspace V5.2 versions antérieures à V5.2.9 | ||
| Siemens | N/A | SIMATIC CP 443-1 OPC UA (6GK7443-1UX00-0XE0) toutes versions | ||
| Siemens | N/A | EN100 Ethernet module PROFINET IO variant toutes versions | ||
| Siemens | N/A | SCALANCE XR552-12M (2HR2) (6GK5552-0AA00-2HR2) versions antérieures à V6.5 | ||
| Siemens | N/A | Teamcenter V12.4 versions antérieures à V12.4.0.13 | ||
| Siemens | N/A | SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0) toutes versions | ||
| Siemens | N/A | SIMATIC CP 1543-1 (incl. SIPLUS variants) versions antérieures à V3.0 | ||
| Siemens | N/A | SIMATIC CP 443-1 Advanced (6GK7443-1GX30-0XE0) toutes versions | ||
| Siemens | N/A | APOGEE PXC Modular (P2 Ethernet) toutes versions | ||
| Siemens | N/A | SIMATIC MV550 H (6GF3550-0GE10) toutes versions | ||
| Siemens | N/A | SIMATIC MV560 U (6GF3560-0LE10) toutes versions | ||
| Siemens | N/A | SIMATIC CP 1545-1 (6GK7545-1GX00-0XE0) versions antérieures à V1.1 | ||
| Siemens | N/A | SIMATIC CP 1626 (6GK1162-6AA01) toutes versions | ||
| Siemens | N/A | SCALANCE XR524-8C, 1x230V (L3 int.) (6GK5524-8GR00-3AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | TIA Portal V16 toutes versions | ||
| Siemens | N/A | RUGGEDCOM CROSSBOW Station Access Controller toutes versions | ||
| Siemens | N/A | Industrial Edge - OPC UA Connector toutes versions | ||
| Siemens | N/A | SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) toutes versions | ||
| Siemens | N/A | Xpedition Designer versions antérieures à X.2.11 | ||
| Siemens | N/A | SIMATIC S7-1500 Software Controller (incl. F) toutes versions | ||
| Siemens | N/A | SICAM GridEdge Essential ARM (6MD7881-2AA30) versions antérieures à V2.6.6 | ||
| Siemens | N/A | SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) toutes versions | ||
| Siemens | N/A | SICAM GridEdge Essential with GDS Intel (6MD7881-2AA20) versions antérieures à V2.6.6 | ||
| Siemens | N/A | SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2) toutes versions | ||
| Siemens | N/A | SCALANCE SC632-2C (6GK5632-2GS00-2AC2) toutes versions versions antérieures à V2.3.1 | ||
| Siemens | N/A | Teamcenter V13.2 toutes versions | ||
| Siemens | N/A | RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) toutes versions | ||
| Siemens | N/A | SIMATIC RF650R (6GT2811-6AB20) versions antérieures à V4.0.1 | ||
| Siemens | N/A | SIMATIC PDM toutes versions | ||
| Siemens | N/A | RUGGEDCOM NMS toutes versions | ||
| Siemens | N/A | TIA Administrator toutes versions | ||
| Siemens | N/A | SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2) toutes versions | ||
| Siemens | N/A | SIMATIC NET PC Software V15 toutes versions | ||
| Siemens | N/A | EN100 Ethernet module IEC 104 variant toutes versions | ||
| Siemens | N/A | SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) toutes versions | ||
| Siemens | N/A | Mendix SAML Module (Mendix 9 compatible) versions antérieures à 3.2.3 | ||
| Siemens | N/A | SCALANCE XM408-4C (6GK5408-4GP00-2AM2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC NET PC Software V17 toutes versions | ||
| Siemens | N/A | Spectrum Power MGMS toutes versions using Shared HIS | ||
| Siemens | N/A | SCALANCE XM408-8C (L3 int.) (6GK5408-8GR00-2AM2) versions antérieures à V6.5 | ||
| Siemens | N/A | SCALANCE SC636-2C (6GK5636-2GS00-2AC2) toutes versions versions antérieures à V2.3.1 | ||
| Siemens | N/A | SIMATIC RF188C (6GT2002-0JE40) versions antérieures à V2.0.1 | ||
| Siemens | N/A | SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) toutes versions | ||
| Siemens | N/A | SICAM GridEdge Essential with GDS ARM (6MD7881-2AA10) versions antérieures à V2.6.6 | ||
| Siemens | N/A | SCALANCE XR526-8C, 24V (6GK5526-8GS00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC RF680R (6GT2811-6AA10) versions antérieures à V4.0.1 | ||
| Siemens | N/A | SINUMERIK Edge versions antérieures à V3.3.0 | ||
| Siemens | N/A | SIMATIC PCS 7 TeleControl toutes versions | ||
| Siemens | N/A | SIMATIC CP 1628 (6GK1162-8AA00) toutes versions | ||
| Siemens | N/A | Teamcenter V13.3 versions antérieures à V13.3.0.3 | ||
| Siemens | N/A | SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2) toutes versions | ||
| Siemens | N/A | Spectrum Power 4 toutes versions using Shared HIS | ||
| Siemens | N/A | SINEC NMS toutes versions | ||
| Siemens | N/A | SCALANCE M804PB (6GK5804-0AP00-2AA2) toutes versions | ||
| Siemens | N/A | SIMATIC RF360R (6GT2801-5BA30) versions antérieures à V2.0.1 | ||
| Siemens | N/A | SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC CP 343-1 Advanced (6GK7343-1GX31-0XE0) toutes versions | ||
| Siemens | N/A | SCALANCE XR524-8C, 24V (L3 int.) (6GK5524-8GR00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | Industrial Edge - SIMATIC S7 Connector App versions antérieures à V1.7.0 | ||
| Siemens | N/A | SIMATIC RF185C (6GT2002-0JE10) versions antérieures à V2.0.1 | ||
| Siemens | N/A | SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) toutes versions | ||
| Siemens | N/A | SIMATIC RF188CI (6GT2002-0JE60) versions antérieures à V2.0.1 | ||
| Siemens | N/A | SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2) toutes versions | ||
| Siemens | N/A | SCALANCE XR526-8C, 24V (L3 int.) (6GK5526-8GR00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | EN100 Ethernet module DNP3 IP variant toutes versions | ||
| Siemens | N/A | APOGEE PXC Modular (BACnet) versions antérieures à V3.5 | ||
| Siemens | N/A | Mendix SAML Module (Mendix 8 compatible) versions antérieures à 2.2.2 | ||
| Siemens | N/A | SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) toutes versions | ||
| Siemens | N/A | SCALANCE LPE9403 (6GK5998-3GS00-2AC2) versions antérieures à V2.0 | ||
| Siemens | N/A | SIMATIC STEP 7 V5.X toutes versions | ||
| Siemens | N/A | SIMATIC RF166C (6GT2002-0EE20) versions antérieures à V2.0.1 | ||
| Siemens | N/A | EN100 Ethernet module Modbus TCP variant toutes versions | ||
| Siemens | N/A | SIMATIC NET PC Software V14 toutes versions | ||
| Siemens | N/A | SCALANCE XR528-6M (L3 int.) (6GK5528-0AR00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC Logon toutes versions | ||
| Siemens | N/A | SCALANCE XM408-4C (L3 int.) (6GK5408-4GQ00-2AM2) versions antérieures à V6.5 | ||
| Siemens | N/A | SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) toutes versions | ||
| Siemens | N/A | SCALANCE XR528-6M (6GK5528-0AA00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SCALANCE XR526-8C, 2x230V (6GK5526-8GS00-4AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SICAM GridEdge Essential Intel (6MD7881-2AA40) versions antérieures à V2.6.6 | ||
| Siemens | N/A | SCALANCE M874-3 (6GK5874-3AA00-2AA2) toutes versions | ||
| Siemens | N/A | SCALANCE XR552-12M (2HR2) (6GK5552-0AR00-2HR2) versions antérieures à V6.5 | ||
| Siemens | N/A | EN100 Ethernet module IEC 61850 variant versions antérieures à V4.37 | ||
| Siemens | N/A | SINEMA Server V14 toutes versions | ||
| Siemens | N/A | SIPLUS NET CP 1242-7 V2 (6AG1242-7KX31-7XE0) toutes versions | ||
| Siemens | N/A | SCALANCE SC642-2C (6GK5642-2GS00-2AC2) toutes versions versions antérieures à V2.3.1 | ||
| Siemens | N/A | SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) toutes versions | ||
| Siemens | N/A | SCALANCE XR524-8C, 24V (6GK5524-8GS00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SCALANCE SC622-2C (6GK5622-2GS00-2AC2) toutes versions versions antérieures à V2.3.1 | ||
| Siemens | N/A | SIPLUS NET CP 443-1 Advanced (6AG1443-1GX30-4XE0) toutes versions | ||
| Siemens | N/A | SIMATIC PCS neo toutes versions | ||
| Siemens | N/A | Teamcenter V13.1 versions antérieures à V13.1.0.9 | ||
| Siemens | N/A | APOGEE PXC Compact (P2 Ethernet) toutes versions | ||
| Siemens | N/A | RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) toutes versions | ||
| Siemens | N/A | SIMATIC WinCC (TIA Portal) toutes versions | ||
| Siemens | N/A | TALON TC Modular (BACnet) versions antérieures à V3.5 | ||
| Siemens | N/A | SINEMA Remote Connect Server versions antérieures à 3.0 SP2 | ||
| Siemens | N/A | RUGGEDCOM ROS Series toutes versions | ||
| Siemens | N/A | SIMATIC STEP 7 (TIA Portal) toutes versions | ||
| Siemens | N/A | SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC MV550 S (6GF3550-0CD10) toutes versions | ||
| Siemens | N/A | SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) toutes versions | ||
| Siemens | N/A | SIMATIC NET PC Software V16 toutes versions | ||
| Siemens | N/A | APOGEE PXC Compact (BACnet) versions antérieures à V3.5 | ||
| Siemens | N/A | SINAUT Software ST7sc toutes versions | ||
| Siemens | N/A | Teamcenter V14.0 toutes versions | ||
| Siemens | N/A | SINAUT ST7CC toutes versions | ||
| Siemens | N/A | SIMATIC CP 1243-7 LTE US (6GK7243-7SX30-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC MV560 X (6GF3560-0HE10) toutes versions | ||
| Siemens | N/A | SCALANCE XR552-12M (6GK5552-0AA00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | TIA Portal V15 toutes versions | ||
| Siemens | N/A | TIA Portal V17 toutes versions | ||
| Siemens | N/A | SINEMA Remote Connect Server versions antérieures à V3.1 | ||
| Siemens | N/A | SCALANCE XM416-4C (L3 int.) (6GK5416-4GR00-2AM2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC RF186C (6GT2002-0JE20) versions antérieures à V2.0.1 | ||
| Siemens | N/A | SCALANCE XR526-8C, 1x230V (6GK5526-8GS00-3AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SCALANCE XR552-12M (2HR2, L3 int.) (6GK5552-0AR00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | TIA Portal Cloud toutes versions | ||
| Siemens | N/A | RUGGEDCOM ROX Series toutes versions | ||
| Siemens | N/A | SIMATIC Cloud Connect 7 CC716 (6GK1411-5AC00) toutes versions | ||
| Siemens | N/A | SCALANCE XR524-8C, 2x230V (L3 int.) (6GK5524-8GR00-4AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC Cloud Connect 7 CC712 (6GK1411-1AC00) toutes versions | ||
| Siemens | N/A | TALON TC Compact (BACnet) versions antérieures à V3.5 | ||
| Siemens | N/A | SIPLUS NET CP 343-1 Advanced (6AG1343-1GX31-4XE0) toutes versions | ||
| Siemens | N/A | SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) toutes versions | ||
| Siemens | N/A | Spectrum Power 7 toutes versions using Shared HIS | ||
| Siemens | N/A | SCALANCE S615 (6GK5615-0AA00-2AA2) toutes versions | ||
| Siemens | N/A | SCALANCE XR524-8C, 1x230V (6GK5524-8GS00-3AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC MV540 H (6GF3540-0GE10) toutes versions | ||
| Siemens | N/A | SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) toutes versions | ||
| Siemens | N/A | SIMATIC ET 200SP Open Controller (incl. SIPLUS variants) toutes versions | ||
| Siemens | N/A | SCALANCE M874-2 (6GK5874-2AA00-2AA2) toutes versions | ||
| Siemens | N/A | SCALANCE XR528-6M (2HR2) (6GK5528-0AA00-2HR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SINEC INS toutes versions | ||
| Siemens | N/A | SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0) toutes versions | ||
| Siemens | N/A | SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2) toutes versions | ||
| Siemens | N/A | SIMATIC RF610R (6GT2811-6BC10) versions antérieures à V4.0.1 | ||
| Siemens | N/A | SCALANCE MUM856-1 (NAM) (6GK5856-2EA00-3BA1) toutes versions | ||
| Siemens | N/A | SCALANCE XR524-8C, 2x230V (6GK5524-8GS00-4AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | Teamcenter V13.0 versions antérieures à V13.0.0.9 | ||
| Siemens | N/A | SIMATIC RF186CI (6GT2002-0JE50) versions antérieures à V2.0.1 | ||
| Siemens | N/A | Teamcenter Active Workspace V6.0 versions antérieures à V6.0.3 | ||
| Siemens | N/A | SCALANCE SC646-2C (6GK5646-2GS00-2AC2) toutes versions versions antérieures à V2.3.1 | ||
| Siemens | N/A | SIMATIC CP 1545-1 (6GK7545-1GX00-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC RF685R (6GT2811-6CA10) versions antérieures à V4.0.1 | ||
| Siemens | N/A | SCALANCE XM416-4C (6GK5416-4GS00-2AM2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) toutes versions | ||
| Siemens | N/A | SCALANCE XM408-8C (6GK5408-8GS00-2AM2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC MV540 S (6GF3540-0CD10) toutes versions | ||
| Siemens | N/A | SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC RF615R (6GT2811-6CC10) versions antérieures à V4.0.1 | ||
| Siemens | N/A | Industrial Edge - PROFINET IO Connector toutes versions | ||
| Siemens | N/A | SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0) toutes versions | ||
| Siemens | N/A | Mendix SAML Module (Mendix 7 compatible) versions antérieures à 1.16.6 | ||
| Siemens | N/A | SCALANCE XR528-6M (2HR2, L3 int.) (6GK5528-0AR00-2HR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SCALANCE XR526-8C, 1x230V (L3 int.) (6GK5526-8GR00-3AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | TeleControl Server Basic V3 toutes versions | ||
| Siemens | N/A | SCALANCE MUM853-1 (RoW) (6GK5853-2EA00-2AA1) toutes versions | ||
| Siemens | N/A | SCALANCE XR526-8C, 2x230V (L3 int.) (6GK5526-8GR00-4AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC S7-PLCSIM Advanced toutes versions | ||
| Siemens | N/A | TIM 1531 IRC (6GK7543-1MX00-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) toutes versions | ||
| Siemens | N/A | SIMATIC S7-1200 CPU family (incl. SIPLUS variants) toutes versions |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Teamcenter Active Workspace V5.2 versions ant\u00e9rieures \u00e0 V5.2.9",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 443-1 OPC UA (6GK7443-1UX00-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "EN100 Ethernet module PROFINET IO variant toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR552-12M (2HR2) (6GK5552-0AA00-2HR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter V12.4 versions ant\u00e9rieures \u00e0 V12.4.0.13",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1543-1 (incl. SIPLUS variants) versions ant\u00e9rieures \u00e0 V3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 443-1 Advanced (6GK7443-1GX30-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Modular (P2 Ethernet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC MV550 H (6GF3550-0GE10) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC MV560 U (6GF3560-0LE10) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1545-1 (6GK7545-1GX00-0XE0) versions ant\u00e9rieures \u00e0 V1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1626 (6GK1162-6AA01) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR524-8C, 1x230V (L3 int.) (6GK5524-8GR00-3AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TIA Portal V16 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM CROSSBOW Station Access Controller toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Industrial Edge - OPC UA Connector toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Xpedition Designer versions ant\u00e9rieures \u00e0 X.2.11",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-1500 Software Controller (incl. F) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SICAM GridEdge Essential ARM (6MD7881-2AA30) versions ant\u00e9rieures \u00e0 V2.6.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SICAM GridEdge Essential with GDS Intel (6MD7881-2AA20) versions ant\u00e9rieures \u00e0 V2.6.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC632-2C (6GK5632-2GS00-2AC2) toutes versions versions ant\u00e9rieures \u00e0 V2.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter V13.2 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF650R (6GT2811-6AB20) versions ant\u00e9rieures \u00e0 V4.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PDM toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM NMS toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TIA Administrator toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC NET PC Software V15 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "EN100 Ethernet module IEC 104 variant toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Mendix SAML Module (Mendix 9 compatible) versions ant\u00e9rieures \u00e0 3.2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XM408-4C (6GK5408-4GP00-2AM2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC NET PC Software V17 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Spectrum Power MGMS toutes versions using Shared HIS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XM408-8C (L3 int.) (6GK5408-8GR00-2AM2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC636-2C (6GK5636-2GS00-2AC2) toutes versions versions ant\u00e9rieures \u00e0 V2.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF188C (6GT2002-0JE40) versions ant\u00e9rieures \u00e0 V2.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SICAM GridEdge Essential with GDS ARM (6MD7881-2AA10) versions ant\u00e9rieures \u00e0 V2.6.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR526-8C, 24V (6GK5526-8GS00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF680R (6GT2811-6AA10) versions ant\u00e9rieures \u00e0 V4.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINUMERIK Edge versions ant\u00e9rieures \u00e0 V3.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PCS 7 TeleControl toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1628 (6GK1162-8AA00) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter V13.3 versions ant\u00e9rieures \u00e0 V13.3.0.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Spectrum Power 4 toutes versions using Shared HIS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEC NMS toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M804PB (6GK5804-0AP00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF360R (6GT2801-5BA30) versions ant\u00e9rieures \u00e0 V2.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 343-1 Advanced (6GK7343-1GX31-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR524-8C, 24V (L3 int.) (6GK5524-8GR00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Industrial Edge - SIMATIC S7 Connector App versions ant\u00e9rieures \u00e0 V1.7.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF185C (6GT2002-0JE10) versions ant\u00e9rieures \u00e0 V2.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF188CI (6GT2002-0JE60) versions ant\u00e9rieures \u00e0 V2.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR526-8C, 24V (L3 int.) (6GK5526-8GR00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "EN100 Ethernet module DNP3 IP variant toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Modular (BACnet) versions ant\u00e9rieures \u00e0 V3.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Mendix SAML Module (Mendix 8 compatible) versions ant\u00e9rieures \u00e0 2.2.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE LPE9403 (6GK5998-3GS00-2AC2) versions ant\u00e9rieures \u00e0 V2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC STEP 7 V5.X toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF166C (6GT2002-0EE20) versions ant\u00e9rieures \u00e0 V2.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "EN100 Ethernet module Modbus TCP variant toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC NET PC Software V14 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR528-6M (L3 int.) (6GK5528-0AR00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC Logon toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XM408-4C (L3 int.) (6GK5408-4GQ00-2AM2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR528-6M (6GK5528-0AA00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR526-8C, 2x230V (6GK5526-8GS00-4AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SICAM GridEdge Essential Intel (6MD7881-2AA40) versions ant\u00e9rieures \u00e0 V2.6.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M874-3 (6GK5874-3AA00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR552-12M (2HR2) (6GK5552-0AR00-2HR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "EN100 Ethernet module IEC 61850 variant versions ant\u00e9rieures \u00e0 V4.37",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEMA Server V14 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS NET CP 1242-7 V2 (6AG1242-7KX31-7XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC642-2C (6GK5642-2GS00-2AC2) toutes versions versions ant\u00e9rieures \u00e0 V2.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR524-8C, 24V (6GK5524-8GS00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC622-2C (6GK5622-2GS00-2AC2) toutes versions versions ant\u00e9rieures \u00e0 V2.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS NET CP 443-1 Advanced (6AG1443-1GX30-4XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PCS neo toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter V13.1 versions ant\u00e9rieures \u00e0 V13.1.0.9",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Compact (P2 Ethernet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC (TIA Portal) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TALON TC Modular (BACnet) versions ant\u00e9rieures \u00e0 V3.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEMA Remote Connect Server versions ant\u00e9rieures \u00e0 3.0 SP2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM ROS Series toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC STEP 7 (TIA Portal) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC MV550 S (6GF3550-0CD10) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC NET PC Software V16 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Compact (BACnet) versions ant\u00e9rieures \u00e0 V3.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINAUT Software ST7sc toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter V14.0 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINAUT ST7CC toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1243-7 LTE US (6GK7243-7SX30-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC MV560 X (6GF3560-0HE10) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR552-12M (6GK5552-0AA00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TIA Portal V15 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TIA Portal V17 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEMA Remote Connect Server versions ant\u00e9rieures \u00e0 V3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XM416-4C (L3 int.) (6GK5416-4GR00-2AM2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF186C (6GT2002-0JE20) versions ant\u00e9rieures \u00e0 V2.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR526-8C, 1x230V (6GK5526-8GS00-3AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR552-12M (2HR2, L3 int.) (6GK5552-0AR00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TIA Portal Cloud toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM ROX Series toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC Cloud Connect 7 CC716 (6GK1411-5AC00) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR524-8C, 2x230V (L3 int.) (6GK5524-8GR00-4AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC Cloud Connect 7 CC712 (6GK1411-1AC00) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TALON TC Compact (BACnet) versions ant\u00e9rieures \u00e0 V3.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS NET CP 343-1 Advanced (6AG1343-1GX31-4XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Spectrum Power 7 toutes versions using Shared HIS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE S615 (6GK5615-0AA00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR524-8C, 1x230V (6GK5524-8GS00-3AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC MV540 H (6GF3540-0GE10) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC ET 200SP Open Controller (incl. SIPLUS variants) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M874-2 (6GK5874-2AA00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR528-6M (2HR2) (6GK5528-0AA00-2HR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEC INS toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF610R (6GT2811-6BC10) versions ant\u00e9rieures \u00e0 V4.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE MUM856-1 (NAM) (6GK5856-2EA00-3BA1) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR524-8C, 2x230V (6GK5524-8GS00-4AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter V13.0 versions ant\u00e9rieures \u00e0 V13.0.0.9",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF186CI (6GT2002-0JE50) versions ant\u00e9rieures \u00e0 V2.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Active Workspace V6.0 versions ant\u00e9rieures \u00e0 V6.0.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC646-2C (6GK5646-2GS00-2AC2) toutes versions versions ant\u00e9rieures \u00e0 V2.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1545-1 (6GK7545-1GX00-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF685R (6GT2811-6CA10) versions ant\u00e9rieures \u00e0 V4.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XM416-4C (6GK5416-4GS00-2AM2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XM408-8C (6GK5408-8GS00-2AM2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC MV540 S (6GF3540-0CD10) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF615R (6GT2811-6CC10) versions ant\u00e9rieures \u00e0 V4.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Industrial Edge - PROFINET IO Connector toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Mendix SAML Module (Mendix 7 compatible) versions ant\u00e9rieures \u00e0 1.16.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR528-6M (2HR2, L3 int.) (6GK5528-0AR00-2HR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR526-8C, 1x230V (L3 int.) (6GK5526-8GR00-3AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TeleControl Server Basic V3 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE MUM853-1 (RoW) (6GK5853-2EA00-2AA1) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR526-8C, 2x230V (L3 int.) (6GK5526-8GR00-4AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-PLCSIM Advanced toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TIM 1531 IRC (6GK7543-1MX00-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-1200 CPU family (incl. SIPLUS variants) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-32285",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32285"
},
{
"name": "CVE-2022-32286",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32286"
},
{
"name": "CVE-2021-45960",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45960"
},
{
"name": "CVE-2021-20317",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20317"
},
{
"name": "CVE-2022-32258",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32258"
},
{
"name": "CVE-2021-41091",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41091"
},
{
"name": "CVE-2021-22925",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22925"
},
{
"name": "CVE-2022-30231",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30231"
},
{
"name": "CVE-2021-33196",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33196"
},
{
"name": "CVE-2022-32254",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32254"
},
{
"name": "CVE-2022-22823",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22823"
},
{
"name": "CVE-2022-32145",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32145"
},
{
"name": "CVE-2022-32259",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32259"
},
{
"name": "CVE-2022-32262",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32262"
},
{
"name": "CVE-2017-9947",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-9947"
},
{
"name": "CVE-2022-32255",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32255"
},
{
"name": "CVE-2020-27304",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-27304"
},
{
"name": "CVE-2022-25315",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25315"
},
{
"name": "CVE-2022-22822",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22822"
},
{
"name": "CVE-2022-32252",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32252"
},
{
"name": "CVE-2021-22924",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22924"
},
{
"name": "CVE-2022-25313",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25313"
},
{
"name": "CVE-2021-39275",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39275"
},
{
"name": "CVE-2021-37182",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-37182"
},
{
"name": "CVE-2020-9272",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-9272"
},
{
"name": "CVE-2021-39293",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39293"
},
{
"name": "CVE-2021-33910",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33910"
},
{
"name": "CVE-2022-23852",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23852"
},
{
"name": "CVE-2022-22825",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22825"
},
{
"name": "CVE-2022-25314",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25314"
},
{
"name": "CVE-2022-23990",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23990"
},
{
"name": "CVE-2022-26476",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26476"
},
{
"name": "CVE-2022-25235",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25235"
},
{
"name": "CVE-2022-0847",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0847"
},
{
"name": "CVE-2022-30228",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30228"
},
{
"name": "CVE-2021-46143",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-46143"
},
{
"name": "CVE-2021-41092",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41092"
},
{
"name": "CVE-2022-32251",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32251"
},
{
"name": "CVE-2021-34798",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34798"
},
{
"name": "CVE-2021-36221",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36221"
},
{
"name": "CVE-2021-41089",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41089"
},
{
"name": "CVE-2022-30230",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30230"
},
{
"name": "CVE-2020-9273",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-9273"
},
{
"name": "CVE-2022-30229",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30229"
},
{
"name": "CVE-2022-22827",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22827"
},
{
"name": "CVE-2022-29034",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29034"
},
{
"name": "CVE-2022-30937",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30937"
},
{
"name": "CVE-2022-25236",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25236"
},
{
"name": "CVE-2022-0778",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0778"
},
{
"name": "CVE-2022-27219",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27219"
},
{
"name": "CVE-2022-27221",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27221"
},
{
"name": "CVE-2022-22826",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22826"
},
{
"name": "CVE-2022-31619",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31619"
},
{
"name": "CVE-2022-32261",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32261"
},
{
"name": "CVE-2022-32260",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32260"
},
{
"name": "CVE-2021-40438",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-40438"
},
{
"name": "CVE-2021-4034",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4034"
},
{
"name": "CVE-2022-22824",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22824"
},
{
"name": "CVE-2022-27220",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27220"
},
{
"name": "CVE-2022-31465",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31465"
},
{
"name": "CVE-2017-9946",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-9946"
},
{
"name": "CVE-2021-41103",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41103"
},
{
"name": "CVE-2022-32253",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32253"
},
{
"name": "CVE-2022-32256",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32256"
},
{
"name": "CVE-2021-37209",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-37209"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-547",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-06-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-148078 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-148078.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-220589 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-220589.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-988345 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-988345.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-484086 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-484086.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-330556 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-330556.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-145224 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-145224.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-685781 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-685781.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-693555 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-693555.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-911567 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-911567.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-401167 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-401167.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-764417 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-764417.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-712929 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-712929.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-679335 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-679335.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-388239 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-388239.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-631336 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-631336.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-740594 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-740594.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-222547 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-222547.html"
}
]
}
CERTFR-2022-AVI-547
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | Teamcenter Active Workspace V5.2 versions antérieures à V5.2.9 | ||
| Siemens | N/A | SIMATIC CP 443-1 OPC UA (6GK7443-1UX00-0XE0) toutes versions | ||
| Siemens | N/A | EN100 Ethernet module PROFINET IO variant toutes versions | ||
| Siemens | N/A | SCALANCE XR552-12M (2HR2) (6GK5552-0AA00-2HR2) versions antérieures à V6.5 | ||
| Siemens | N/A | Teamcenter V12.4 versions antérieures à V12.4.0.13 | ||
| Siemens | N/A | SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0) toutes versions | ||
| Siemens | N/A | SIMATIC CP 1543-1 (incl. SIPLUS variants) versions antérieures à V3.0 | ||
| Siemens | N/A | SIMATIC CP 443-1 Advanced (6GK7443-1GX30-0XE0) toutes versions | ||
| Siemens | N/A | APOGEE PXC Modular (P2 Ethernet) toutes versions | ||
| Siemens | N/A | SIMATIC MV550 H (6GF3550-0GE10) toutes versions | ||
| Siemens | N/A | SIMATIC MV560 U (6GF3560-0LE10) toutes versions | ||
| Siemens | N/A | SIMATIC CP 1545-1 (6GK7545-1GX00-0XE0) versions antérieures à V1.1 | ||
| Siemens | N/A | SIMATIC CP 1626 (6GK1162-6AA01) toutes versions | ||
| Siemens | N/A | SCALANCE XR524-8C, 1x230V (L3 int.) (6GK5524-8GR00-3AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | TIA Portal V16 toutes versions | ||
| Siemens | N/A | RUGGEDCOM CROSSBOW Station Access Controller toutes versions | ||
| Siemens | N/A | Industrial Edge - OPC UA Connector toutes versions | ||
| Siemens | N/A | SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) toutes versions | ||
| Siemens | N/A | Xpedition Designer versions antérieures à X.2.11 | ||
| Siemens | N/A | SIMATIC S7-1500 Software Controller (incl. F) toutes versions | ||
| Siemens | N/A | SICAM GridEdge Essential ARM (6MD7881-2AA30) versions antérieures à V2.6.6 | ||
| Siemens | N/A | SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) toutes versions | ||
| Siemens | N/A | SICAM GridEdge Essential with GDS Intel (6MD7881-2AA20) versions antérieures à V2.6.6 | ||
| Siemens | N/A | SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2) toutes versions | ||
| Siemens | N/A | SCALANCE SC632-2C (6GK5632-2GS00-2AC2) toutes versions versions antérieures à V2.3.1 | ||
| Siemens | N/A | Teamcenter V13.2 toutes versions | ||
| Siemens | N/A | RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) toutes versions | ||
| Siemens | N/A | SIMATIC RF650R (6GT2811-6AB20) versions antérieures à V4.0.1 | ||
| Siemens | N/A | SIMATIC PDM toutes versions | ||
| Siemens | N/A | RUGGEDCOM NMS toutes versions | ||
| Siemens | N/A | TIA Administrator toutes versions | ||
| Siemens | N/A | SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2) toutes versions | ||
| Siemens | N/A | SIMATIC NET PC Software V15 toutes versions | ||
| Siemens | N/A | EN100 Ethernet module IEC 104 variant toutes versions | ||
| Siemens | N/A | SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) toutes versions | ||
| Siemens | N/A | Mendix SAML Module (Mendix 9 compatible) versions antérieures à 3.2.3 | ||
| Siemens | N/A | SCALANCE XM408-4C (6GK5408-4GP00-2AM2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC NET PC Software V17 toutes versions | ||
| Siemens | N/A | Spectrum Power MGMS toutes versions using Shared HIS | ||
| Siemens | N/A | SCALANCE XM408-8C (L3 int.) (6GK5408-8GR00-2AM2) versions antérieures à V6.5 | ||
| Siemens | N/A | SCALANCE SC636-2C (6GK5636-2GS00-2AC2) toutes versions versions antérieures à V2.3.1 | ||
| Siemens | N/A | SIMATIC RF188C (6GT2002-0JE40) versions antérieures à V2.0.1 | ||
| Siemens | N/A | SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) toutes versions | ||
| Siemens | N/A | SICAM GridEdge Essential with GDS ARM (6MD7881-2AA10) versions antérieures à V2.6.6 | ||
| Siemens | N/A | SCALANCE XR526-8C, 24V (6GK5526-8GS00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC RF680R (6GT2811-6AA10) versions antérieures à V4.0.1 | ||
| Siemens | N/A | SINUMERIK Edge versions antérieures à V3.3.0 | ||
| Siemens | N/A | SIMATIC PCS 7 TeleControl toutes versions | ||
| Siemens | N/A | SIMATIC CP 1628 (6GK1162-8AA00) toutes versions | ||
| Siemens | N/A | Teamcenter V13.3 versions antérieures à V13.3.0.3 | ||
| Siemens | N/A | SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2) toutes versions | ||
| Siemens | N/A | Spectrum Power 4 toutes versions using Shared HIS | ||
| Siemens | N/A | SINEC NMS toutes versions | ||
| Siemens | N/A | SCALANCE M804PB (6GK5804-0AP00-2AA2) toutes versions | ||
| Siemens | N/A | SIMATIC RF360R (6GT2801-5BA30) versions antérieures à V2.0.1 | ||
| Siemens | N/A | SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC CP 343-1 Advanced (6GK7343-1GX31-0XE0) toutes versions | ||
| Siemens | N/A | SCALANCE XR524-8C, 24V (L3 int.) (6GK5524-8GR00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | Industrial Edge - SIMATIC S7 Connector App versions antérieures à V1.7.0 | ||
| Siemens | N/A | SIMATIC RF185C (6GT2002-0JE10) versions antérieures à V2.0.1 | ||
| Siemens | N/A | SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) toutes versions | ||
| Siemens | N/A | SIMATIC RF188CI (6GT2002-0JE60) versions antérieures à V2.0.1 | ||
| Siemens | N/A | SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2) toutes versions | ||
| Siemens | N/A | SCALANCE XR526-8C, 24V (L3 int.) (6GK5526-8GR00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | EN100 Ethernet module DNP3 IP variant toutes versions | ||
| Siemens | N/A | APOGEE PXC Modular (BACnet) versions antérieures à V3.5 | ||
| Siemens | N/A | Mendix SAML Module (Mendix 8 compatible) versions antérieures à 2.2.2 | ||
| Siemens | N/A | SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) toutes versions | ||
| Siemens | N/A | SCALANCE LPE9403 (6GK5998-3GS00-2AC2) versions antérieures à V2.0 | ||
| Siemens | N/A | SIMATIC STEP 7 V5.X toutes versions | ||
| Siemens | N/A | SIMATIC RF166C (6GT2002-0EE20) versions antérieures à V2.0.1 | ||
| Siemens | N/A | EN100 Ethernet module Modbus TCP variant toutes versions | ||
| Siemens | N/A | SIMATIC NET PC Software V14 toutes versions | ||
| Siemens | N/A | SCALANCE XR528-6M (L3 int.) (6GK5528-0AR00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC Logon toutes versions | ||
| Siemens | N/A | SCALANCE XM408-4C (L3 int.) (6GK5408-4GQ00-2AM2) versions antérieures à V6.5 | ||
| Siemens | N/A | SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) toutes versions | ||
| Siemens | N/A | SCALANCE XR528-6M (6GK5528-0AA00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SCALANCE XR526-8C, 2x230V (6GK5526-8GS00-4AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SICAM GridEdge Essential Intel (6MD7881-2AA40) versions antérieures à V2.6.6 | ||
| Siemens | N/A | SCALANCE M874-3 (6GK5874-3AA00-2AA2) toutes versions | ||
| Siemens | N/A | SCALANCE XR552-12M (2HR2) (6GK5552-0AR00-2HR2) versions antérieures à V6.5 | ||
| Siemens | N/A | EN100 Ethernet module IEC 61850 variant versions antérieures à V4.37 | ||
| Siemens | N/A | SINEMA Server V14 toutes versions | ||
| Siemens | N/A | SIPLUS NET CP 1242-7 V2 (6AG1242-7KX31-7XE0) toutes versions | ||
| Siemens | N/A | SCALANCE SC642-2C (6GK5642-2GS00-2AC2) toutes versions versions antérieures à V2.3.1 | ||
| Siemens | N/A | SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) toutes versions | ||
| Siemens | N/A | SCALANCE XR524-8C, 24V (6GK5524-8GS00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SCALANCE SC622-2C (6GK5622-2GS00-2AC2) toutes versions versions antérieures à V2.3.1 | ||
| Siemens | N/A | SIPLUS NET CP 443-1 Advanced (6AG1443-1GX30-4XE0) toutes versions | ||
| Siemens | N/A | SIMATIC PCS neo toutes versions | ||
| Siemens | N/A | Teamcenter V13.1 versions antérieures à V13.1.0.9 | ||
| Siemens | N/A | APOGEE PXC Compact (P2 Ethernet) toutes versions | ||
| Siemens | N/A | RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) toutes versions | ||
| Siemens | N/A | SIMATIC WinCC (TIA Portal) toutes versions | ||
| Siemens | N/A | TALON TC Modular (BACnet) versions antérieures à V3.5 | ||
| Siemens | N/A | SINEMA Remote Connect Server versions antérieures à 3.0 SP2 | ||
| Siemens | N/A | RUGGEDCOM ROS Series toutes versions | ||
| Siemens | N/A | SIMATIC STEP 7 (TIA Portal) toutes versions | ||
| Siemens | N/A | SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC MV550 S (6GF3550-0CD10) toutes versions | ||
| Siemens | N/A | SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) toutes versions | ||
| Siemens | N/A | SIMATIC NET PC Software V16 toutes versions | ||
| Siemens | N/A | APOGEE PXC Compact (BACnet) versions antérieures à V3.5 | ||
| Siemens | N/A | SINAUT Software ST7sc toutes versions | ||
| Siemens | N/A | Teamcenter V14.0 toutes versions | ||
| Siemens | N/A | SINAUT ST7CC toutes versions | ||
| Siemens | N/A | SIMATIC CP 1243-7 LTE US (6GK7243-7SX30-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC MV560 X (6GF3560-0HE10) toutes versions | ||
| Siemens | N/A | SCALANCE XR552-12M (6GK5552-0AA00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | TIA Portal V15 toutes versions | ||
| Siemens | N/A | TIA Portal V17 toutes versions | ||
| Siemens | N/A | SINEMA Remote Connect Server versions antérieures à V3.1 | ||
| Siemens | N/A | SCALANCE XM416-4C (L3 int.) (6GK5416-4GR00-2AM2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC RF186C (6GT2002-0JE20) versions antérieures à V2.0.1 | ||
| Siemens | N/A | SCALANCE XR526-8C, 1x230V (6GK5526-8GS00-3AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SCALANCE XR552-12M (2HR2, L3 int.) (6GK5552-0AR00-2AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | TIA Portal Cloud toutes versions | ||
| Siemens | N/A | RUGGEDCOM ROX Series toutes versions | ||
| Siemens | N/A | SIMATIC Cloud Connect 7 CC716 (6GK1411-5AC00) toutes versions | ||
| Siemens | N/A | SCALANCE XR524-8C, 2x230V (L3 int.) (6GK5524-8GR00-4AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC Cloud Connect 7 CC712 (6GK1411-1AC00) toutes versions | ||
| Siemens | N/A | TALON TC Compact (BACnet) versions antérieures à V3.5 | ||
| Siemens | N/A | SIPLUS NET CP 343-1 Advanced (6AG1343-1GX31-4XE0) toutes versions | ||
| Siemens | N/A | SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) toutes versions | ||
| Siemens | N/A | Spectrum Power 7 toutes versions using Shared HIS | ||
| Siemens | N/A | SCALANCE S615 (6GK5615-0AA00-2AA2) toutes versions | ||
| Siemens | N/A | SCALANCE XR524-8C, 1x230V (6GK5524-8GS00-3AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC MV540 H (6GF3540-0GE10) toutes versions | ||
| Siemens | N/A | SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) toutes versions | ||
| Siemens | N/A | SIMATIC ET 200SP Open Controller (incl. SIPLUS variants) toutes versions | ||
| Siemens | N/A | SCALANCE M874-2 (6GK5874-2AA00-2AA2) toutes versions | ||
| Siemens | N/A | SCALANCE XR528-6M (2HR2) (6GK5528-0AA00-2HR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SINEC INS toutes versions | ||
| Siemens | N/A | SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0) toutes versions | ||
| Siemens | N/A | SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2) toutes versions | ||
| Siemens | N/A | SIMATIC RF610R (6GT2811-6BC10) versions antérieures à V4.0.1 | ||
| Siemens | N/A | SCALANCE MUM856-1 (NAM) (6GK5856-2EA00-3BA1) toutes versions | ||
| Siemens | N/A | SCALANCE XR524-8C, 2x230V (6GK5524-8GS00-4AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | Teamcenter V13.0 versions antérieures à V13.0.0.9 | ||
| Siemens | N/A | SIMATIC RF186CI (6GT2002-0JE50) versions antérieures à V2.0.1 | ||
| Siemens | N/A | Teamcenter Active Workspace V6.0 versions antérieures à V6.0.3 | ||
| Siemens | N/A | SCALANCE SC646-2C (6GK5646-2GS00-2AC2) toutes versions versions antérieures à V2.3.1 | ||
| Siemens | N/A | SIMATIC CP 1545-1 (6GK7545-1GX00-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC RF685R (6GT2811-6CA10) versions antérieures à V4.0.1 | ||
| Siemens | N/A | SCALANCE XM416-4C (6GK5416-4GS00-2AM2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) toutes versions | ||
| Siemens | N/A | SCALANCE XM408-8C (6GK5408-8GS00-2AM2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC MV540 S (6GF3540-0CD10) toutes versions | ||
| Siemens | N/A | SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC RF615R (6GT2811-6CC10) versions antérieures à V4.0.1 | ||
| Siemens | N/A | Industrial Edge - PROFINET IO Connector toutes versions | ||
| Siemens | N/A | SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0) toutes versions | ||
| Siemens | N/A | Mendix SAML Module (Mendix 7 compatible) versions antérieures à 1.16.6 | ||
| Siemens | N/A | SCALANCE XR528-6M (2HR2, L3 int.) (6GK5528-0AR00-2HR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SCALANCE XR526-8C, 1x230V (L3 int.) (6GK5526-8GR00-3AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | TeleControl Server Basic V3 toutes versions | ||
| Siemens | N/A | SCALANCE MUM853-1 (RoW) (6GK5853-2EA00-2AA1) toutes versions | ||
| Siemens | N/A | SCALANCE XR526-8C, 2x230V (L3 int.) (6GK5526-8GR00-4AR2) versions antérieures à V6.5 | ||
| Siemens | N/A | SIMATIC S7-PLCSIM Advanced toutes versions | ||
| Siemens | N/A | TIM 1531 IRC (6GK7543-1MX00-0XE0) toutes versions | ||
| Siemens | N/A | SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) toutes versions | ||
| Siemens | N/A | SIMATIC S7-1200 CPU family (incl. SIPLUS variants) toutes versions |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Teamcenter Active Workspace V5.2 versions ant\u00e9rieures \u00e0 V5.2.9",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 443-1 OPC UA (6GK7443-1UX00-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "EN100 Ethernet module PROFINET IO variant toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR552-12M (2HR2) (6GK5552-0AA00-2HR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter V12.4 versions ant\u00e9rieures \u00e0 V12.4.0.13",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1543-1 (incl. SIPLUS variants) versions ant\u00e9rieures \u00e0 V3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 443-1 Advanced (6GK7443-1GX30-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Modular (P2 Ethernet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC MV550 H (6GF3550-0GE10) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC MV560 U (6GF3560-0LE10) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1545-1 (6GK7545-1GX00-0XE0) versions ant\u00e9rieures \u00e0 V1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1626 (6GK1162-6AA01) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR524-8C, 1x230V (L3 int.) (6GK5524-8GR00-3AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TIA Portal V16 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM CROSSBOW Station Access Controller toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Industrial Edge - OPC UA Connector toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Xpedition Designer versions ant\u00e9rieures \u00e0 X.2.11",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-1500 Software Controller (incl. F) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SICAM GridEdge Essential ARM (6MD7881-2AA30) versions ant\u00e9rieures \u00e0 V2.6.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SICAM GridEdge Essential with GDS Intel (6MD7881-2AA20) versions ant\u00e9rieures \u00e0 V2.6.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC632-2C (6GK5632-2GS00-2AC2) toutes versions versions ant\u00e9rieures \u00e0 V2.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter V13.2 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF650R (6GT2811-6AB20) versions ant\u00e9rieures \u00e0 V4.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PDM toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM NMS toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TIA Administrator toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC NET PC Software V15 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "EN100 Ethernet module IEC 104 variant toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Mendix SAML Module (Mendix 9 compatible) versions ant\u00e9rieures \u00e0 3.2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XM408-4C (6GK5408-4GP00-2AM2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC NET PC Software V17 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Spectrum Power MGMS toutes versions using Shared HIS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XM408-8C (L3 int.) (6GK5408-8GR00-2AM2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC636-2C (6GK5636-2GS00-2AC2) toutes versions versions ant\u00e9rieures \u00e0 V2.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF188C (6GT2002-0JE40) versions ant\u00e9rieures \u00e0 V2.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SICAM GridEdge Essential with GDS ARM (6MD7881-2AA10) versions ant\u00e9rieures \u00e0 V2.6.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR526-8C, 24V (6GK5526-8GS00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF680R (6GT2811-6AA10) versions ant\u00e9rieures \u00e0 V4.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINUMERIK Edge versions ant\u00e9rieures \u00e0 V3.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PCS 7 TeleControl toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1628 (6GK1162-8AA00) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter V13.3 versions ant\u00e9rieures \u00e0 V13.3.0.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Spectrum Power 4 toutes versions using Shared HIS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEC NMS toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M804PB (6GK5804-0AP00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF360R (6GT2801-5BA30) versions ant\u00e9rieures \u00e0 V2.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 343-1 Advanced (6GK7343-1GX31-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR524-8C, 24V (L3 int.) (6GK5524-8GR00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Industrial Edge - SIMATIC S7 Connector App versions ant\u00e9rieures \u00e0 V1.7.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF185C (6GT2002-0JE10) versions ant\u00e9rieures \u00e0 V2.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF188CI (6GT2002-0JE60) versions ant\u00e9rieures \u00e0 V2.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR526-8C, 24V (L3 int.) (6GK5526-8GR00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "EN100 Ethernet module DNP3 IP variant toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Modular (BACnet) versions ant\u00e9rieures \u00e0 V3.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Mendix SAML Module (Mendix 8 compatible) versions ant\u00e9rieures \u00e0 2.2.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE LPE9403 (6GK5998-3GS00-2AC2) versions ant\u00e9rieures \u00e0 V2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC STEP 7 V5.X toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF166C (6GT2002-0EE20) versions ant\u00e9rieures \u00e0 V2.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "EN100 Ethernet module Modbus TCP variant toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC NET PC Software V14 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR528-6M (L3 int.) (6GK5528-0AR00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC Logon toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XM408-4C (L3 int.) (6GK5408-4GQ00-2AM2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR528-6M (6GK5528-0AA00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR526-8C, 2x230V (6GK5526-8GS00-4AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SICAM GridEdge Essential Intel (6MD7881-2AA40) versions ant\u00e9rieures \u00e0 V2.6.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M874-3 (6GK5874-3AA00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR552-12M (2HR2) (6GK5552-0AR00-2HR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "EN100 Ethernet module IEC 61850 variant versions ant\u00e9rieures \u00e0 V4.37",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEMA Server V14 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS NET CP 1242-7 V2 (6AG1242-7KX31-7XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC642-2C (6GK5642-2GS00-2AC2) toutes versions versions ant\u00e9rieures \u00e0 V2.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR524-8C, 24V (6GK5524-8GS00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC622-2C (6GK5622-2GS00-2AC2) toutes versions versions ant\u00e9rieures \u00e0 V2.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS NET CP 443-1 Advanced (6AG1443-1GX30-4XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PCS neo toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter V13.1 versions ant\u00e9rieures \u00e0 V13.1.0.9",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Compact (P2 Ethernet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC (TIA Portal) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TALON TC Modular (BACnet) versions ant\u00e9rieures \u00e0 V3.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEMA Remote Connect Server versions ant\u00e9rieures \u00e0 3.0 SP2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM ROS Series toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC STEP 7 (TIA Portal) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC MV550 S (6GF3550-0CD10) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC NET PC Software V16 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Compact (BACnet) versions ant\u00e9rieures \u00e0 V3.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINAUT Software ST7sc toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter V14.0 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINAUT ST7CC toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1243-7 LTE US (6GK7243-7SX30-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC MV560 X (6GF3560-0HE10) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR552-12M (6GK5552-0AA00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TIA Portal V15 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TIA Portal V17 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEMA Remote Connect Server versions ant\u00e9rieures \u00e0 V3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XM416-4C (L3 int.) (6GK5416-4GR00-2AM2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF186C (6GT2002-0JE20) versions ant\u00e9rieures \u00e0 V2.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR526-8C, 1x230V (6GK5526-8GS00-3AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR552-12M (2HR2, L3 int.) (6GK5552-0AR00-2AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TIA Portal Cloud toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM ROX Series toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC Cloud Connect 7 CC716 (6GK1411-5AC00) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR524-8C, 2x230V (L3 int.) (6GK5524-8GR00-4AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC Cloud Connect 7 CC712 (6GK1411-1AC00) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TALON TC Compact (BACnet) versions ant\u00e9rieures \u00e0 V3.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS NET CP 343-1 Advanced (6AG1343-1GX31-4XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Spectrum Power 7 toutes versions using Shared HIS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE S615 (6GK5615-0AA00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR524-8C, 1x230V (6GK5524-8GS00-3AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC MV540 H (6GF3540-0GE10) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC ET 200SP Open Controller (incl. SIPLUS variants) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M874-2 (6GK5874-2AA00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR528-6M (2HR2) (6GK5528-0AA00-2HR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEC INS toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF610R (6GT2811-6BC10) versions ant\u00e9rieures \u00e0 V4.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE MUM856-1 (NAM) (6GK5856-2EA00-3BA1) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR524-8C, 2x230V (6GK5524-8GS00-4AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter V13.0 versions ant\u00e9rieures \u00e0 V13.0.0.9",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF186CI (6GT2002-0JE50) versions ant\u00e9rieures \u00e0 V2.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Active Workspace V6.0 versions ant\u00e9rieures \u00e0 V6.0.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC646-2C (6GK5646-2GS00-2AC2) toutes versions versions ant\u00e9rieures \u00e0 V2.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1545-1 (6GK7545-1GX00-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF685R (6GT2811-6CA10) versions ant\u00e9rieures \u00e0 V4.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XM416-4C (6GK5416-4GS00-2AM2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XM408-8C (6GK5408-8GS00-2AM2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC MV540 S (6GF3540-0CD10) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF615R (6GT2811-6CC10) versions ant\u00e9rieures \u00e0 V4.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Industrial Edge - PROFINET IO Connector toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Mendix SAML Module (Mendix 7 compatible) versions ant\u00e9rieures \u00e0 1.16.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR528-6M (2HR2, L3 int.) (6GK5528-0AR00-2HR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR526-8C, 1x230V (L3 int.) (6GK5526-8GR00-3AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TeleControl Server Basic V3 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE MUM853-1 (RoW) (6GK5853-2EA00-2AA1) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XR526-8C, 2x230V (L3 int.) (6GK5526-8GR00-4AR2) versions ant\u00e9rieures \u00e0 V6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-PLCSIM Advanced toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TIM 1531 IRC (6GK7543-1MX00-0XE0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-1200 CPU family (incl. SIPLUS variants) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-32285",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32285"
},
{
"name": "CVE-2022-32286",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32286"
},
{
"name": "CVE-2021-45960",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45960"
},
{
"name": "CVE-2021-20317",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20317"
},
{
"name": "CVE-2022-32258",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32258"
},
{
"name": "CVE-2021-41091",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41091"
},
{
"name": "CVE-2021-22925",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22925"
},
{
"name": "CVE-2022-30231",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30231"
},
{
"name": "CVE-2021-33196",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33196"
},
{
"name": "CVE-2022-32254",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32254"
},
{
"name": "CVE-2022-22823",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22823"
},
{
"name": "CVE-2022-32145",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32145"
},
{
"name": "CVE-2022-32259",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32259"
},
{
"name": "CVE-2022-32262",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32262"
},
{
"name": "CVE-2017-9947",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-9947"
},
{
"name": "CVE-2022-32255",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32255"
},
{
"name": "CVE-2020-27304",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-27304"
},
{
"name": "CVE-2022-25315",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25315"
},
{
"name": "CVE-2022-22822",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22822"
},
{
"name": "CVE-2022-32252",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32252"
},
{
"name": "CVE-2021-22924",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22924"
},
{
"name": "CVE-2022-25313",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25313"
},
{
"name": "CVE-2021-39275",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39275"
},
{
"name": "CVE-2021-37182",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-37182"
},
{
"name": "CVE-2020-9272",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-9272"
},
{
"name": "CVE-2021-39293",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39293"
},
{
"name": "CVE-2021-33910",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33910"
},
{
"name": "CVE-2022-23852",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23852"
},
{
"name": "CVE-2022-22825",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22825"
},
{
"name": "CVE-2022-25314",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25314"
},
{
"name": "CVE-2022-23990",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23990"
},
{
"name": "CVE-2022-26476",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26476"
},
{
"name": "CVE-2022-25235",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25235"
},
{
"name": "CVE-2022-0847",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0847"
},
{
"name": "CVE-2022-30228",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30228"
},
{
"name": "CVE-2021-46143",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-46143"
},
{
"name": "CVE-2021-41092",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41092"
},
{
"name": "CVE-2022-32251",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32251"
},
{
"name": "CVE-2021-34798",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34798"
},
{
"name": "CVE-2021-36221",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36221"
},
{
"name": "CVE-2021-41089",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41089"
},
{
"name": "CVE-2022-30230",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30230"
},
{
"name": "CVE-2020-9273",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-9273"
},
{
"name": "CVE-2022-30229",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30229"
},
{
"name": "CVE-2022-22827",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22827"
},
{
"name": "CVE-2022-29034",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29034"
},
{
"name": "CVE-2022-30937",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30937"
},
{
"name": "CVE-2022-25236",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25236"
},
{
"name": "CVE-2022-0778",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0778"
},
{
"name": "CVE-2022-27219",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27219"
},
{
"name": "CVE-2022-27221",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27221"
},
{
"name": "CVE-2022-22826",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22826"
},
{
"name": "CVE-2022-31619",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31619"
},
{
"name": "CVE-2022-32261",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32261"
},
{
"name": "CVE-2022-32260",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32260"
},
{
"name": "CVE-2021-40438",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-40438"
},
{
"name": "CVE-2021-4034",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4034"
},
{
"name": "CVE-2022-22824",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22824"
},
{
"name": "CVE-2022-27220",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27220"
},
{
"name": "CVE-2022-31465",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31465"
},
{
"name": "CVE-2017-9946",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-9946"
},
{
"name": "CVE-2021-41103",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41103"
},
{
"name": "CVE-2022-32253",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32253"
},
{
"name": "CVE-2022-32256",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32256"
},
{
"name": "CVE-2021-37209",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-37209"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-547",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-06-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-148078 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-148078.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-220589 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-220589.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-988345 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-988345.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-484086 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-484086.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-330556 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-330556.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-145224 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-145224.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-685781 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-685781.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-693555 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-693555.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-911567 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-911567.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-401167 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-401167.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-764417 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-764417.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-712929 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-712929.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-679335 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-679335.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-388239 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-388239.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-631336 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-631336.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-740594 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-740594.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-222547 du 14 juin 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-222547.html"
}
]
}
CERTFR-2026-AVI-0199
Vulnerability from certfr_avis - Published: 2026-02-24 - Updated: 2026-02-24
De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| VMware | Telco Cloud Platform | Telco Cloud Platform versions 4.x et 5.x sans le correctif de sécurité KB428241 | ||
| VMware | Tanzu Data Services | Tanzu Data Flow versions antérieures à 2.0.2 sur Tanzu Platform | ||
| VMware | Azure Spring Enterprise | Harbor Registry versions antérieures à 2.14.2 | ||
| VMware | Tanzu Data Intelligence | Tanzu pour MySQL versions 2.0.0 sur Kubernetes | ||
| VMware | Cloud Foundation | Cloud Foundation versions 9.x antérieures à 9.0.2.0 | ||
| VMware | Tanzu Kubernetes Runtime | App Metrics versions antérieures à2.3.3 | ||
| VMware | Tanzu Data Intelligence | Tanzu GemFire versions antérieures à 2.6.1 sur Kubernetes | ||
| VMware | Tanzu Kubernetes Runtime | CredHub Secrets Management pour Tanzu Platform versions antérieures à 1.6.8 | ||
| VMware | Tanzu Data Intelligence | Tanzu pour Valkey version 3.3.1 sur Kubernetes | ||
| VMware | Tanzu Operations Manager | Foundation Core pour Tanzu Platform versions antérieures à 3.2.4 | ||
| VMware | Aria Operations | Aria Operations versions 8.x antérieures à 8.18.6 | ||
| VMware | Tanzu Kubernetes Runtime | cf-mgmt pour Tanzu Platform versions antérieures à 1.0.108 | ||
| VMware | Tanzu Data Intelligence | Tanzu pour Valkey version 9.0.1 | ||
| VMware | Tanzu Kubernetes Runtime | Extended App Support pour Tanzu Platform versions antérieures à 1.0.15 | ||
| VMware | Tanzu Data Intelligence | Tanzu GemFire Management versions antérieures à 1.4.3 | ||
| VMware | Tanzu Kubernetes Runtime | NodeJS Buildpack versions antérieures à 1.8.77 | ||
| VMware | Tanzu Kubernetes Runtime | Cloud Native Buildpacks pour Tanzu Platform versions antérieures à 0.6.5 | ||
| VMware | Cloud Foundation | Cloud Foundation versions 4.x et 5.x sans le correctif de sécurité KB92148 | ||
| VMware | Tanzu Kubernetes Runtime | AI Services pour Tanzu Platform versions antérieures à 10.3.4 | ||
| VMware | Tanzu Kubernetes Runtime | Java Buildpack versions antérieures à 4.89.0 | ||
| VMware | Telco Cloud Infrastructure | Telco Cloud Infrastructure versions 2.x et 3.x sans le correctif de sécurité KB428241 | ||
| VMware | Tanzu Kubernetes Runtime | Elastic Application Runtime pour Tanzu Platform versions antérieures à 6.0.25+LTS-T, 10.2.8+LTS-T et 10.3.5 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Telco Cloud Platform versions 4.x et 5.x sans le correctif de s\u00e9curit\u00e9 KB428241",
"product": {
"name": "Telco Cloud Platform",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Tanzu Data Flow versions ant\u00e9rieures \u00e0 2.0.2 sur Tanzu Platform",
"product": {
"name": "Tanzu Data Services",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Harbor Registry versions ant\u00e9rieures \u00e0 2.14.2",
"product": {
"name": "Azure Spring Enterprise",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Tanzu pour MySQL versions 2.0.0 sur Kubernetes",
"product": {
"name": "Tanzu Data Intelligence",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Cloud Foundation versions 9.x ant\u00e9rieures \u00e0 9.0.2.0",
"product": {
"name": "Cloud Foundation",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "App Metrics versions ant\u00e9rieures \u00e02.3.3",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Tanzu GemFire versions ant\u00e9rieures \u00e0 2.6.1 sur Kubernetes",
"product": {
"name": "Tanzu Data Intelligence",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "CredHub Secrets Management pour Tanzu Platform versions ant\u00e9rieures \u00e0 1.6.8",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Tanzu pour Valkey version 3.3.1 sur Kubernetes",
"product": {
"name": "Tanzu Data Intelligence",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Foundation Core pour Tanzu Platform versions ant\u00e9rieures \u00e0 3.2.4",
"product": {
"name": "Tanzu Operations Manager",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Aria Operations versions 8.x ant\u00e9rieures \u00e0 8.18.6",
"product": {
"name": "Aria Operations",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "cf-mgmt pour Tanzu Platform versions ant\u00e9rieures \u00e0 1.0.108",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Tanzu pour Valkey version 9.0.1",
"product": {
"name": "Tanzu Data Intelligence",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Extended App Support pour Tanzu Platform versions ant\u00e9rieures \u00e0 1.0.15",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Tanzu GemFire Management versions ant\u00e9rieures \u00e0 1.4.3",
"product": {
"name": "Tanzu Data Intelligence",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "NodeJS Buildpack versions ant\u00e9rieures \u00e0 1.8.77",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Cloud Native Buildpacks pour Tanzu Platform versions ant\u00e9rieures \u00e0 0.6.5",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Cloud Foundation versions 4.x et 5.x sans le correctif de s\u00e9curit\u00e9 KB92148",
"product": {
"name": "Cloud Foundation",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "AI Services pour Tanzu Platform versions ant\u00e9rieures \u00e0 10.3.4",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Java Buildpack versions ant\u00e9rieures \u00e0 4.89.0",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Telco Cloud Infrastructure versions 2.x et 3.x sans le correctif de s\u00e9curit\u00e9 KB428241",
"product": {
"name": "Telco Cloud Infrastructure",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Elastic Application Runtime pour Tanzu Platform versions ant\u00e9rieures \u00e0 6.0.25+LTS-T, 10.2.8+LTS-T et 10.3.5",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-6395",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6395"
},
{
"name": "CVE-2022-1343",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1343"
},
{
"name": "CVE-2024-24790",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24790"
},
{
"name": "CVE-2025-47219",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47219"
},
{
"name": "CVE-2021-22898",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22898"
},
{
"name": "CVE-2021-3996",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3996"
},
{
"name": "CVE-2021-42384",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42384"
},
{
"name": "CVE-2023-0216",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0216"
},
{
"name": "CVE-2025-31651",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31651"
},
{
"name": "CVE-2024-20919",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20919"
},
{
"name": "CVE-2022-35252",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35252"
},
{
"name": "CVE-2022-1473",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1473"
},
{
"name": "CVE-2023-21938",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21938"
},
{
"name": "CVE-2025-61730",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61730"
},
{
"name": "CVE-2022-32189",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32189"
},
{
"name": "CVE-2017-16544",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-16544"
},
{
"name": "CVE-2025-39987",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39987"
},
{
"name": "CVE-2021-42378",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42378"
},
{
"name": "CVE-2023-0401",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0401"
},
{
"name": "CVE-2025-21861",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21861"
},
{
"name": "CVE-2026-21933",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21933"
},
{
"name": "CVE-2025-58183",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58183"
},
{
"name": "CVE-2023-21843",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21843"
},
{
"name": "CVE-2026-21932",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21932"
},
{
"name": "CVE-2022-24450",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24450"
},
{
"name": "CVE-2025-66199",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66199"
},
{
"name": "CVE-2025-15282",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15282"
},
{
"name": "CVE-2024-21235",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21235"
},
{
"name": "CVE-2024-9681",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-9681"
},
{
"name": "CVE-2021-37600",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-37600"
},
{
"name": "CVE-2021-42382",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42382"
},
{
"name": "CVE-2020-10750",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10750"
},
{
"name": "CVE-2025-68973",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68973"
},
{
"name": "CVE-2022-30631",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30631"
},
{
"name": "CVE-2023-46218",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-46218"
},
{
"name": "CVE-2025-40055",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40055"
},
{
"name": "CVE-2021-42376",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42376"
},
{
"name": "CVE-2025-9714",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9714"
},
{
"name": "CVE-2026-22801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22801"
},
{
"name": "CVE-2025-39876",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39876"
},
{
"name": "CVE-2025-40029",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40029"
},
{
"name": "CVE-2025-38561",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38561"
},
{
"name": "CVE-2025-10148",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10148"
},
{
"name": "CVE-2023-28841",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28841"
},
{
"name": "CVE-2023-28840",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28840"
},
{
"name": "CVE-2025-40048",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40048"
},
{
"name": "CVE-2022-27191",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27191"
},
{
"name": "CVE-2025-40219",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40219"
},
{
"name": "CVE-2024-21144",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21144"
},
{
"name": "CVE-2025-40043",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40043"
},
{
"name": "CVE-2020-8169",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8169"
},
{
"name": "CVE-2021-41091",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41091"
},
{
"name": "CVE-2022-27781",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27781"
},
{
"name": "CVE-2021-22925",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22925"
},
{
"name": "CVE-2025-8556",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8556"
},
{
"name": "CVE-2026-21936",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21936"
},
{
"name": "CVE-2025-59775",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59775"
},
{
"name": "CVE-2026-21937",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21937"
},
{
"name": "CVE-2025-39973",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39973"
},
{
"name": "CVE-2025-22872",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22872"
},
{
"name": "CVE-2025-8941",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8941"
},
{
"name": "CVE-2025-66614",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66614"
},
{
"name": "CVE-2018-1000517",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000517"
},
{
"name": "CVE-2025-15469",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15469"
},
{
"name": "CVE-2025-39943",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39943"
},
{
"name": "CVE-2025-39945",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39945"
},
{
"name": "CVE-2025-39883",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39883"
},
{
"name": "CVE-2023-29404",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29404"
},
{
"name": "CVE-2023-21954",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21954"
},
{
"name": "CVE-2022-4304",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4304"
},
{
"name": "CVE-2023-21939",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21939"
},
{
"name": "CVE-2022-0563",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0563"
},
{
"name": "CVE-2024-20926",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20926"
},
{
"name": "CVE-2025-0913",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0913"
},
{
"name": "CVE-2025-40019",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40019"
},
{
"name": "CVE-2025-40240",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40240"
},
{
"name": "CVE-2022-24921",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24921"
},
{
"name": "CVE-2022-32208",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32208"
},
{
"name": "CVE-2022-28327",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28327"
},
{
"name": "CVE-2025-40081",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40081"
},
{
"name": "CVE-2025-47907",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47907"
},
{
"name": "CVE-2024-58011",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-58011"
},
{
"name": "CVE-2025-12084",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12084"
},
{
"name": "CVE-2025-40026",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40026"
},
{
"name": "CVE-2025-40153",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40153"
},
{
"name": "CVE-2022-1292",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1292"
},
{
"name": "CVE-2023-45283",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45283"
},
{
"name": "CVE-2025-40121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40121"
},
{
"name": "CVE-2026-1642",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1642"
},
{
"name": "CVE-2025-45582",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-45582"
},
{
"name": "CVE-2024-21068",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21068"
},
{
"name": "CVE-2025-55753",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55753"
},
{
"name": "CVE-2025-11468",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11468"
},
{
"name": "CVE-2025-40204",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40204"
},
{
"name": "CVE-2025-40171",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40171"
},
{
"name": "CVE-2021-43816",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43816"
},
{
"name": "CVE-2023-45288",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45288"
},
{
"name": "CVE-2025-6069",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6069"
},
{
"name": "CVE-2023-3817",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3817"
},
{
"name": "CVE-2025-39911",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39911"
},
{
"name": "CVE-2025-69419",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69419"
},
{
"name": "CVE-2025-6052",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6052"
},
{
"name": "CVE-2022-41725",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41725"
},
{
"name": "CVE-2025-10543",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10543"
},
{
"name": "CVE-2025-40125",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40125"
},
{
"name": "CVE-2025-40349",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40349"
},
{
"name": "CVE-2025-6075",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6075"
},
{
"name": "CVE-2019-5481",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5481"
},
{
"name": "CVE-2025-26646",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26646"
},
{
"name": "CVE-2022-30635",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30635"
},
{
"name": "CVE-2022-29222",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29222"
},
{
"name": "CVE-2025-40187",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40187"
},
{
"name": "CVE-2025-58185",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58185"
},
{
"name": "CVE-2022-41715",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41715"
},
{
"name": "CVE-2024-21012",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21012"
},
{
"name": "CVE-2025-39913",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39913"
},
{
"name": "CVE-2022-32207",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32207"
},
{
"name": "CVE-2025-40092",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40092"
},
{
"name": "CVE-2022-41722",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41722"
},
{
"name": "CVE-2025-61731",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61731"
},
{
"name": "CVE-2023-0215",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0215"
},
{
"name": "CVE-2025-39967",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39967"
},
{
"name": "CVE-2025-40115",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40115"
},
{
"name": "CVE-2023-0286",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
},
{
"name": "CVE-2021-42386",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42386"
},
{
"name": "CVE-2024-47561",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47561"
},
{
"name": "CVE-2023-45285",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45285"
},
{
"name": "CVE-2025-13837",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13837"
},
{
"name": "CVE-2025-55752",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55752"
},
{
"name": "CVE-2024-24783",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24783"
},
{
"name": "CVE-2023-45284",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45284"
},
{
"name": "CVE-2025-39949",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39949"
},
{
"name": "CVE-2023-29403",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29403"
},
{
"name": "CVE-2022-27776",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27776"
},
{
"name": "CVE-2022-29190",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29190"
},
{
"name": "CVE-2025-40173",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40173"
},
{
"name": "CVE-2024-24791",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24791"
},
{
"name": "CVE-2024-20921",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20921"
},
{
"name": "CVE-2022-42916",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42916"
},
{
"name": "CVE-2022-28948",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28948"
},
{
"name": "CVE-2025-58767",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58767"
},
{
"name": "CVE-2024-56538",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56538"
},
{
"name": "CVE-2025-39923",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39923"
},
{
"name": "CVE-2023-4807",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4807"
},
{
"name": "CVE-2025-15367",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15367"
},
{
"name": "CVE-2022-31030",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31030"
},
{
"name": "CVE-2024-45341",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45341"
},
{
"name": "CVE-2018-20679",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20679"
},
{
"name": "CVE-2024-13176",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-13176"
},
{
"name": "CVE-2025-39953",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39953"
},
{
"name": "CVE-2025-15467",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15467"
},
{
"name": "CVE-2023-2253",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2253"
},
{
"name": "CVE-2024-58251",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-58251"
},
{
"name": "CVE-2026-2006",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2006"
},
{
"name": "CVE-2022-21624",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21624"
},
{
"name": "CVE-2023-28322",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28322"
},
{
"name": "CVE-2023-34462",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-34462"
},
{
"name": "CVE-2025-40167",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40167"
},
{
"name": "CVE-2023-29405",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29405"
},
{
"name": "CVE-2021-38297",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38297"
},
{
"name": "CVE-2025-39969",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39969"
},
{
"name": "CVE-2025-4598",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4598"
},
{
"name": "CVE-2025-27144",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27144"
},
{
"name": "CVE-2017-15873",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-15873"
},
{
"name": "CVE-2022-30629",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30629"
},
{
"name": "CVE-2025-40194",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40194"
},
{
"name": "CVE-2025-40245",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40245"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2023-5363",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5363"
},
{
"name": "CVE-2024-24557",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24557"
},
{
"name": "CVE-2023-45289",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45289"
},
{
"name": "CVE-2022-2068",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2068"
},
{
"name": "CVE-2023-25193",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25193"
},
{
"name": "CVE-2025-40001",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40001"
},
{
"name": "CVE-2026-1485",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1485"
},
{
"name": "CVE-2024-29025",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29025"
},
{
"name": "CVE-2023-0466",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0466"
},
{
"name": "CVE-2022-27782",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27782"
},
{
"name": "CVE-2022-32149",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32149"
},
{
"name": "CVE-2025-40035",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40035"
},
{
"name": "CVE-2023-0465",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0465"
},
{
"name": "CVE-2025-39988",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39988"
},
{
"name": "CVE-2026-22719",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22719"
},
{
"name": "CVE-2022-32148",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32148"
},
{
"name": "CVE-2026-2005",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2005"
},
{
"name": "CVE-2020-8177",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8177"
},
{
"name": "CVE-2023-22081",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22081"
},
{
"name": "CVE-2022-39399",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39399"
},
{
"name": "CVE-2022-4203",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4203"
},
{
"name": "CVE-2025-38584",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38584"
},
{
"name": "CVE-2021-42374",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42374"
},
{
"name": "CVE-2025-50106",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-50106"
},
{
"name": "CVE-2025-40233",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40233"
},
{
"name": "CVE-2025-40020",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40020"
},
{
"name": "CVE-2023-3635",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3635"
},
{
"name": "CVE-2025-40188",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40188"
},
{
"name": "CVE-2020-1971",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1971"
},
{
"name": "CVE-2023-22041",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22041"
},
{
"name": "CVE-2022-21626",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21626"
},
{
"name": "CVE-2025-66200",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66200"
},
{
"name": "CVE-2025-58057",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58057"
},
{
"name": "CVE-2021-41771",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41771"
},
{
"name": "CVE-2025-8291",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8291"
},
{
"name": "CVE-2023-45290",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45290"
},
{
"name": "CVE-2023-28320",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28320"
},
{
"name": "CVE-2026-22795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22795"
},
{
"name": "CVE-2023-34231",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-34231"
},
{
"name": "CVE-2026-0988",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0988"
},
{
"name": "CVE-2025-61727",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61727"
},
{
"name": "CVE-2025-22866",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22866"
},
{
"name": "CVE-2026-21925",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21925"
},
{
"name": "CVE-2024-26308",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26308"
},
{
"name": "CVE-2024-34158",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34158"
},
{
"name": "CVE-2025-30754",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30754"
},
{
"name": "CVE-2025-65637",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-65637"
},
{
"name": "CVE-2022-30630",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30630"
},
{
"name": "CVE-2026-0861",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0861"
},
{
"name": "CVE-2023-47090",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-47090"
},
{
"name": "CVE-2025-40049",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40049"
},
{
"name": "CVE-2025-47910",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47910"
},
{
"name": "CVE-2021-4160",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4160"
},
{
"name": "CVE-2025-40070",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40070"
},
{
"name": "CVE-2022-29946",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29946"
},
{
"name": "CVE-2025-40106",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40106"
},
{
"name": "CVE-2023-0217",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0217"
},
{
"name": "CVE-2022-43552",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43552"
},
{
"name": "CVE-2024-51744",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-51744"
},
{
"name": "CVE-2022-3786",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3786"
},
{
"name": "CVE-2021-3995",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3995"
},
{
"name": "CVE-2021-22947",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22947"
},
{
"name": "CVE-2025-40205",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40205"
},
{
"name": "CVE-2023-48795",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-48795"
},
{
"name": "CVE-2025-6965",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6965"
},
{
"name": "CVE-2023-28319",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28319"
},
{
"name": "CVE-2025-10966",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10966"
},
{
"name": "CVE-2021-22922",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22922"
},
{
"name": "CVE-2025-47906",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47906"
},
{
"name": "CVE-2022-22576",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22576"
},
{
"name": "CVE-2021-38561",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38561"
},
{
"name": "CVE-2025-59375",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59375"
},
{
"name": "CVE-2021-39293",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39293"
},
{
"name": "CVE-2025-31133",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31133"
},
{
"name": "CVE-2025-8194",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8194"
},
{
"name": "CVE-2024-29018",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29018"
},
{
"name": "CVE-2022-1705",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1705"
},
{
"name": "CVE-2024-11053",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-11053"
},
{
"name": "CVE-2024-7264",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-7264"
},
{
"name": "CVE-2025-40027",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40027"
},
{
"name": "CVE-2025-39885",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39885"
},
{
"name": "CVE-2022-3510",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3510"
},
{
"name": "CVE-2022-3509",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3509"
},
{
"name": "CVE-2021-22946",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22946"
},
{
"name": "CVE-2025-69421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69421"
},
{
"name": "CVE-2020-8284",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8284"
},
{
"name": "CVE-2023-23915",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23915"
},
{
"name": "CVE-2025-4517",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4517"
},
{
"name": "CVE-2025-58188",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58188"
},
{
"name": "CVE-2025-30215",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30215"
},
{
"name": "CVE-2016-9843",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9843"
},
{
"name": "CVE-2023-39318",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39318"
},
{
"name": "CVE-2024-40635",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40635"
},
{
"name": "CVE-2022-41720",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41720"
},
{
"name": "CVE-2026-21948",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21948"
},
{
"name": "CVE-2025-4674",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4674"
},
{
"name": "CVE-2022-41716",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41716"
},
{
"name": "CVE-2025-39970",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39970"
},
{
"name": "CVE-2021-3711",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3711"
},
{
"name": "CVE-2025-39994",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39994"
},
{
"name": "CVE-2025-52999",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-52999"
},
{
"name": "CVE-2024-56433",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56433"
},
{
"name": "CVE-2023-0464",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0464"
},
{
"name": "CVE-2022-29526",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29526"
},
{
"name": "CVE-2025-40088",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40088"
},
{
"name": "CVE-2025-40220",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40220"
},
{
"name": "CVE-2021-3449",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3449"
},
{
"name": "CVE-2022-30633",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30633"
},
{
"name": "CVE-2023-22036",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22036"
},
{
"name": "CVE-2025-13151",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13151"
},
{
"name": "CVE-2025-22058",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22058"
},
{
"name": "CVE-2024-21634",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21634"
},
{
"name": "CVE-2022-28391",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28391"
},
{
"name": "CVE-2022-38749",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38749"
},
{
"name": "CVE-2025-40109",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40109"
},
{
"name": "CVE-2025-40006",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40006"
},
{
"name": "CVE-2022-21628",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21628"
},
{
"name": "CVE-2024-21011",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21011"
},
{
"name": "CVE-2025-6020",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6020"
},
{
"name": "CVE-2025-68161",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68161"
},
{
"name": "CVE-2024-45336",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45336"
},
{
"name": "CVE-2025-52881",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-52881"
},
{
"name": "CVE-2023-28842",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28842"
},
{
"name": "CVE-2025-7425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-7425"
},
{
"name": "CVE-2023-3978",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3978"
},
{
"name": "CVE-2022-26652",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26652"
},
{
"name": "CVE-2025-40011",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40011"
},
{
"name": "CVE-2024-5535",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5535"
},
{
"name": "CVE-2025-40085",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40085"
},
{
"name": "CVE-2023-42365",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42365"
},
{
"name": "CVE-2025-40231",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40231"
},
{
"name": "CVE-2025-22868",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22868"
},
{
"name": "CVE-2022-27775",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27775"
},
{
"name": "CVE-2026-22796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22796"
},
{
"name": "CVE-2021-42379",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42379"
},
{
"name": "CVE-2025-61724",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61724"
},
{
"name": "CVE-2024-5642",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5642"
},
{
"name": "CVE-2023-23914",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23914"
},
{
"name": "CVE-2025-23143",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23143"
},
{
"name": "CVE-2022-30632",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30632"
},
{
"name": "CVE-2025-65082",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-65082"
},
{
"name": "CVE-2024-47554",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47554"
},
{
"name": "CVE-2022-27774",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27774"
},
{
"name": "CVE-2023-25173",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25173"
},
{
"name": "CVE-2025-61732",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61732"
},
{
"name": "CVE-2025-61723",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61723"
},
{
"name": "CVE-2025-9232",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9232"
},
{
"name": "CVE-2023-29406",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29406"
},
{
"name": "CVE-2023-39319",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39319"
},
{
"name": "CVE-2026-21964",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21964"
},
{
"name": "CVE-2025-21587",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21587"
},
{
"name": "CVE-2024-24785",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24785"
},
{
"name": "CVE-2025-46394",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-46394"
},
{
"name": "CVE-2022-36109",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36109"
},
{
"name": "CVE-2025-68146",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68146"
},
{
"name": "CVE-2025-40183",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40183"
},
{
"name": "CVE-2021-42381",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42381"
},
{
"name": "CVE-2026-21441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21441"
},
{
"name": "CVE-2022-1962",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1962"
},
{
"name": "CVE-2024-45337",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45337"
},
{
"name": "CVE-2024-21147",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21147"
},
{
"name": "CVE-2022-41717",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41717"
},
{
"name": "CVE-2025-39998",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39998"
},
{
"name": "CVE-2025-13836",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13836"
},
{
"name": "CVE-2023-39410",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39410"
},
{
"name": "CVE-2025-43857",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43857"
},
{
"name": "CVE-2023-28321",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28321"
},
{
"name": "CVE-2024-25710",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25710"
},
{
"name": "CVE-2025-40134",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40134"
},
{
"name": "CVE-2017-15874",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-15874"
},
{
"name": "CVE-2024-7254",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-7254"
},
{
"name": "CVE-2025-61725",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61725"
},
{
"name": "CVE-2026-25210",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25210"
},
{
"name": "CVE-2025-39968",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39968"
},
{
"name": "CVE-2023-24536",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24536"
},
{
"name": "CVE-2022-42915",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42915"
},
{
"name": "CVE-2022-32221",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32221"
},
{
"name": "CVE-2022-29458",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29458"
},
{
"name": "CVE-2025-55163",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55163"
},
{
"name": "CVE-2025-39986",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39986"
},
{
"name": "CVE-2025-39955",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39955"
},
{
"name": "CVE-2025-66293",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66293"
},
{
"name": "CVE-2022-24769",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24769"
},
{
"name": "CVE-2022-28131",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28131"
},
{
"name": "CVE-2025-12818",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12818"
},
{
"name": "CVE-2025-58098",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58098"
},
{
"name": "CVE-2025-32990",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32990"
},
{
"name": "CVE-2021-22897",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22897"
},
{
"name": "CVE-2025-40078",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40078"
},
{
"name": "CVE-2025-15366",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15366"
},
{
"name": "CVE-2022-24675",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24675"
},
{
"name": "CVE-2024-21140",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21140"
},
{
"name": "CVE-2025-40116",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40116"
},
{
"name": "CVE-2025-68249",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68249"
},
{
"name": "CVE-2026-0990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0990"
},
{
"name": "CVE-2025-39934",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39934"
},
{
"name": "CVE-2026-0865",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0865"
},
{
"name": "CVE-2024-21094",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21094"
},
{
"name": "CVE-2024-9143",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-9143"
},
{
"name": "CVE-2022-23806",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23806"
},
{
"name": "CVE-2025-40179",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40179"
},
{
"name": "CVE-2025-40127",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40127"
},
{
"name": "CVE-2025-32989",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32989"
},
{
"name": "CVE-2025-39996",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39996"
},
{
"name": "CVE-2025-22874",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22874"
},
{
"name": "CVE-2026-22721",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22721"
},
{
"name": "CVE-2025-40053",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40053"
},
{
"name": "CVE-2026-24515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24515"
},
{
"name": "CVE-2025-39951",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39951"
},
{
"name": "CVE-2022-1271",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1271"
},
{
"name": "CVE-2025-40120",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40120"
},
{
"name": "CVE-2024-28085",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28085"
},
{
"name": "CVE-2024-41110",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41110"
},
{
"name": "CVE-2025-50059",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-50059"
},
{
"name": "CVE-2022-48174",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-48174"
},
{
"name": "CVE-2025-61594",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61594"
},
{
"name": "CVE-2023-21835",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21835"
},
{
"name": "CVE-2024-34156",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34156"
},
{
"name": "CVE-2022-2880",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2880"
},
{
"name": "CVE-2025-5025",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5025"
},
{
"name": "CVE-2023-21937",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21937"
},
{
"name": "CVE-2025-40243",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40243"
},
{
"name": "CVE-2022-23773",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23773"
},
{
"name": "CVE-2021-41089",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41089"
},
{
"name": "CVE-2023-24539",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24539"
},
{
"name": "CVE-2025-14104",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14104"
},
{
"name": "CVE-2023-6237",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6237"
},
{
"name": "CVE-2026-21968",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21968"
},
{
"name": "CVE-2021-46848",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-46848"
},
{
"name": "CVE-2025-30761",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30761"
},
{
"name": "CVE-2025-47912",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47912"
},
{
"name": "CVE-2023-25153",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25153"
},
{
"name": "CVE-2024-47535",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47535"
},
{
"name": "CVE-2022-4450",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4450"
},
{
"name": "CVE-2023-2650",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2650"
},
{
"name": "CVE-2025-68160",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68160"
},
{
"name": "CVE-2023-42364",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42364"
},
{
"name": "CVE-2025-54410",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-54410"
},
{
"name": "CVE-2022-3996",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3996"
},
{
"name": "CVE-2022-2879",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2879"
},
{
"name": "CVE-2025-40118",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40118"
},
{
"name": "CVE-2022-32205",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32205"
},
{
"name": "CVE-2023-27534",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27534"
},
{
"name": "CVE-2024-2398",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2398"
},
{
"name": "CVE-2023-24532",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24532"
},
{
"name": "CVE-2025-52565",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-52565"
},
{
"name": "CVE-2025-40021",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40021"
},
{
"name": "CVE-2025-67735",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67735"
},
{
"name": "CVE-2022-23772",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23772"
},
{
"name": "CVE-2025-61728",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61728"
},
{
"name": "CVE-2022-43551",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43551"
},
{
"name": "CVE-2022-42004",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42004"
},
{
"name": "CVE-2019-5747",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5747"
},
{
"name": "CVE-2025-58186",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58186"
},
{
"name": "CVE-2025-30698",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30698"
},
{
"name": "CVE-2025-40044",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40044"
},
{
"name": "CVE-2023-27533",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27533"
},
{
"name": "CVE-2025-40105",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40105"
},
{
"name": "CVE-2018-1000500",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000500"
},
{
"name": "CVE-2025-9086",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9086"
},
{
"name": "CVE-2026-26014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26014"
},
{
"name": "CVE-2021-41772",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41772"
},
{
"name": "CVE-2025-40112",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40112"
},
{
"name": "CVE-2024-27289",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27289"
},
{
"name": "CVE-2024-0727",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0727"
},
{
"name": "CVE-2025-58187",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58187"
},
{
"name": "CVE-2023-6129",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6129"
},
{
"name": "CVE-2025-39971",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39971"
},
{
"name": "CVE-2025-40154",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40154"
},
{
"name": "CVE-2025-13601",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13601"
},
{
"name": "CVE-2025-12817",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12817"
},
{
"name": "CVE-2025-4673",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4673"
},
{
"name": "CVE-2026-23949",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23949"
},
{
"name": "CVE-2021-42385",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42385"
},
{
"name": "CVE-2023-22045",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22045"
},
{
"name": "CVE-2023-29400",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29400"
},
{
"name": "CVE-2025-58056",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58056"
},
{
"name": "CVE-2025-22871",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22871"
},
{
"name": "CVE-2024-21138",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21138"
},
{
"name": "CVE-2025-32988",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32988"
},
{
"name": "CVE-2023-22049",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22049"
},
{
"name": "CVE-2024-24787",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24787"
},
{
"name": "CVE-2026-0915",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0915"
},
{
"name": "CVE-2025-15281",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15281"
},
{
"name": "CVE-2022-0778",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0778"
},
{
"name": "CVE-2022-41854",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41854"
},
{
"name": "CVE-2022-41724",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41724"
},
{
"name": "CVE-2020-8908",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8908"
},
{
"name": "CVE-2024-6119",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6119"
},
{
"name": "CVE-2022-30634",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30634"
},
{
"name": "CVE-2025-40126",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40126"
},
{
"name": "CVE-2025-39972",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39972"
},
{
"name": "CVE-2025-24294",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24294"
},
{
"name": "CVE-2025-58181",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58181"
},
{
"name": "CVE-2021-42836",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42836"
},
{
"name": "CVE-2021-44716",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44716"
},
{
"name": "CVE-2025-47914",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47914"
},
{
"name": "CVE-2023-1255",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1255"
},
{
"name": "CVE-2025-69418",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69418"
},
{
"name": "CVE-2025-58058",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58058"
},
{
"name": "CVE-2025-22869",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22869"
},
{
"name": "CVE-2025-40200",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40200"
},
{
"name": "CVE-2022-3358",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3358"
},
{
"name": "CVE-2025-38236",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38236"
},
{
"name": "CVE-2025-15468",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15468"
},
{
"name": "CVE-2025-40124",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40124"
},
{
"name": "CVE-2025-39880",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39880"
},
{
"name": "CVE-2025-58189",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58189"
},
{
"name": "CVE-2025-6021",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6021"
},
{
"name": "CVE-2025-40094",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40094"
},
{
"name": "CVE-2022-2097",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2097"
},
{
"name": "CVE-2023-24540",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24540"
},
{
"name": "CVE-2024-4603",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4603"
},
{
"name": "CVE-2022-25857",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25857"
},
{
"name": "CVE-2022-38751",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38751"
},
{
"name": "CVE-2025-25193",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25193"
},
{
"name": "CVE-2024-8096",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8096"
},
{
"name": "CVE-2026-21945",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21945"
},
{
"name": "CVE-2024-21145",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21145"
},
{
"name": "CVE-2022-32206",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32206"
},
{
"name": "CVE-2026-21941",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21941"
},
{
"name": "CVE-2025-22870",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22870"
},
{
"name": "CVE-2025-40215",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40215"
},
{
"name": "CVE-2025-40111",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40111"
},
{
"name": "CVE-2021-3712",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3712"
},
{
"name": "CVE-2023-21968",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21968"
},
{
"name": "CVE-2025-40068",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40068"
},
{
"name": "CVE-2025-40042",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40042"
},
{
"name": "CVE-2025-32415",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32415"
},
{
"name": "CVE-2023-24537",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24537"
},
{
"name": "CVE-2025-5889",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5889"
},
{
"name": "CVE-2025-30749",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30749"
},
{
"name": "CVE-2026-22695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22695"
},
{
"name": "CVE-2026-23490",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23490"
},
{
"name": "CVE-2026-24733",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24733"
},
{
"name": "CVE-2026-0992",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0992"
},
{
"name": "CVE-2025-9230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9230"
},
{
"name": "CVE-2026-21947",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21947"
},
{
"name": "CVE-2025-66564",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66564"
},
{
"name": "CVE-2023-45287",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45287"
},
{
"name": "CVE-2024-4741",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4741"
},
{
"name": "CVE-2019-5482",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5482"
},
{
"name": "CVE-2025-48924",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48924"
},
{
"name": "CVE-2023-21930",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21930"
},
{
"name": "CVE-2022-38752",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38752"
},
{
"name": "CVE-2021-22926",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22926"
},
{
"name": "CVE-2025-8916",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8916"
},
{
"name": "CVE-2025-32414",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32414"
},
{
"name": "CVE-2025-39937",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39937"
},
{
"name": "CVE-2025-11187",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11187"
},
{
"name": "CVE-2024-20918",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20918"
},
{
"name": "CVE-2025-40060",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40060"
},
{
"name": "CVE-2026-2003",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2003"
},
{
"name": "CVE-2019-5443",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5443"
},
{
"name": "CVE-2022-38750",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38750"
},
{
"name": "CVE-2022-30580",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30580"
},
{
"name": "CVE-2022-23471",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23471"
},
{
"name": "CVE-2020-1967",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1967"
},
{
"name": "CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"name": "CVE-2025-60876",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60876"
},
{
"name": "CVE-2023-24531",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24531"
},
{
"name": "CVE-2021-23840",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-23840"
},
{
"name": "CVE-2023-24538",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24538"
},
{
"name": "CVE-2023-2975",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2975"
},
{
"name": "CVE-2022-42003",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42003"
},
{
"name": "CVE-2021-44717",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44717"
},
{
"name": "CVE-2025-11065",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11065"
},
{
"name": "CVE-2022-3602",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3602"
},
{
"name": "CVE-2026-1484",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1484"
},
{
"name": "CVE-2025-4947",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4947"
},
{
"name": "CVE-2025-40178",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40178"
},
{
"name": "CVE-2022-29804",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29804"
},
{
"name": "CVE-2025-39869",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39869"
},
{
"name": "CVE-2025-0725",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0725"
},
{
"name": "CVE-2023-2976",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2976"
},
{
"name": "CVE-2025-39985",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39985"
},
{
"name": "CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"name": "CVE-2022-1434",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1434"
},
{
"name": "CVE-2021-22923",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22923"
},
{
"name": "CVE-2022-41723",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41723"
},
{
"name": "CVE-2025-59464",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59464"
},
{
"name": "CVE-2023-22006",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22006"
},
{
"name": "CVE-2019-5435",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5435"
},
{
"name": "CVE-2022-1471",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1471"
},
{
"name": "CVE-2025-8058",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8058"
},
{
"name": "CVE-2026-1489",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1489"
},
{
"name": "CVE-2023-39323",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39323"
},
{
"name": "CVE-2023-29402",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29402"
},
{
"name": "CVE-2026-2004",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2004"
},
{
"name": "CVE-2026-0672",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0672"
},
{
"name": "CVE-2025-8732",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8732"
},
{
"name": "CVE-2023-39326",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39326"
},
{
"name": "CVE-2024-21085",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21085"
},
{
"name": "CVE-2021-43565",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43565"
},
{
"name": "CVE-2025-21502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21502"
},
{
"name": "CVE-2023-29409",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29409"
},
{
"name": "CVE-2022-23648",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23648"
},
{
"name": "CVE-2021-23841",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-23841"
},
{
"name": "CVE-2025-30204",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30204"
},
{
"name": "CVE-2023-39325",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39325"
},
{
"name": "CVE-2025-5914",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5914"
},
{
"name": "CVE-2026-22720",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22720"
},
{
"name": "CVE-2024-20945",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20945"
},
{
"name": "CVE-2023-42363",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42363"
},
{
"name": "CVE-2023-24534",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24534"
},
{
"name": "CVE-2024-21131",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21131"
},
{
"name": "CVE-2025-39980",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39980"
},
{
"name": "CVE-2024-21210",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21210"
},
{
"name": "CVE-2023-3446",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3446"
},
{
"name": "CVE-2024-2511",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2511"
},
{
"name": "CVE-2025-53057",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53057"
},
{
"name": "CVE-2024-24786",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24786"
},
{
"name": "CVE-2022-3171",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3171"
},
{
"name": "CVE-2019-1551",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1551"
},
{
"name": "CVE-2025-40346",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40346"
},
{
"name": "CVE-2023-21967",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21967"
},
{
"name": "CVE-2024-34155",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34155"
},
{
"name": "CVE-2022-21619",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21619"
},
{
"name": "CVE-2025-40030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40030"
},
{
"name": "CVE-2025-40244",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40244"
},
{
"name": "CVE-2025-39995",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39995"
},
{
"name": "CVE-2025-68119",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68119"
},
{
"name": "CVE-2022-21698",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21698"
},
{
"name": "CVE-2025-53066",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53066"
},
{
"name": "CVE-2025-22873",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22873"
},
{
"name": "CVE-2023-5678",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5678"
},
{
"name": "CVE-2024-24784",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24784"
},
{
"name": "CVE-2022-27780",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27780"
},
{
"name": "CVE-2025-39907",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39907"
},
{
"name": "CVE-2023-42366",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42366"
},
{
"name": "CVE-2024-21217",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21217"
},
{
"name": "CVE-2025-0167",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0167"
},
{
"name": "CVE-2026-25547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25547"
},
{
"name": "CVE-2025-69420",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69420"
},
{
"name": "CVE-2024-20952",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20952"
},
{
"name": "CVE-2025-40140",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40140"
},
{
"name": "CVE-2024-24789",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24789"
},
{
"name": "CVE-2025-40223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40223"
},
{
"name": "CVE-2022-27664",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27664"
},
{
"name": "CVE-2026-1225",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1225"
},
{
"name": "CVE-2024-53114",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53114"
},
{
"name": "CVE-2024-27304",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27304"
},
{
"name": "CVE-2026-22703",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22703"
},
{
"name": "CVE-2026-0989",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0989"
},
{
"name": "CVE-2025-61729",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61729"
},
{
"name": "CVE-2025-39873",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39873"
},
{
"name": "CVE-2024-21208",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21208"
},
{
"name": "CVE-2023-23916",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23916"
},
{
"name": "CVE-2022-29189",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29189"
},
{
"name": "CVE-2025-38248",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38248"
},
{
"name": "CVE-2025-40351",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40351"
},
{
"name": "CVE-2025-40087",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40087"
},
{
"name": "CVE-2026-25646",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25646"
}
],
"initial_release_date": "2026-02-24T00:00:00",
"last_revision_date": "2026-02-24T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0199",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-02-24T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits VMware. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
"vendor_advisories": [
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37012",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37012"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37001",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37001"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37013",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37013"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37003",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37003"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37023",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37023"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37017",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37017"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37006",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37006"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37024",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37024"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 36997",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36997"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37004",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37004"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 36947",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37018",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37018"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37005",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37005"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37008",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37008"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37007",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37007"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37020",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37020"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 36998",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36998"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37002",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37002"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37021",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37021"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37022",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37022"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37016",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37016"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37019",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37019"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37010",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37010"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37009",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37009"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37000",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37000"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37011",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37011"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37015",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37015"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37014",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37014"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 36999",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36999"
}
]
}
BDU:2023-07629
Vulnerability from fstec - Published: 09.09.2021
VLAI Severity ?
Title
Уязвимость средства автоматизации развёртывания и управления приложениями в средах с поддержкой контейнеризации Docker, связанная с неправильным сохранением разрешений, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Description
Уязвимость средства автоматизации развёртывания и управления приложениями в средах с поддержкой контейнеризации Docker связана с неправильным сохранением разрешений. Эксплуатация уязвимости может позволить нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Severity ?
Vendor
Сообщество свободного программного обеспечения, ООО «РусБИТех-Астра», Docker Inc., АО "НППКТ"
Software Name
Debian GNU/Linux, Astra Linux Special Edition (запись в едином реестре российских программ №369), Docker, ОСОН ОСнова Оnyx (запись в едином реестре российских программ №5913)
Software Version
10 (Debian GNU/Linux), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 1.7 (Astra Linux Special Edition), до 20.10.9 (Docker), 4.7 (Astra Linux Special Edition), до 2.9 (ОСОН ОСнова Оnyx)
Possible Mitigations
Для Docker:
использование рекомендаций производителя: https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558
Для Debian:
использование рекомендаций производителя: https://security-tracker.debian.org/tracker/CVE-2021-41091
Для ОС Astra Linux:
обновить пакет docker.io до 24.0.2+astra14 или более высокой версии, используя рекомендации производителя: https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17
Для ОСОН ОСнова Оnyx:
Обновление программного обеспечения docker.io до версии 20.10.5+dfsg1-1+deb11u2.osnova8
Для Astra Linux Special Edition 4.7:
обновить пакет docker.io до 24.0.2+ci1 или более высокой версии, используя рекомендации производителя: https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47
Reference
https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64
https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558
https://nvd.nist.gov/vuln/detail/CVE-2021-41091
https://security-tracker.debian.org/tracker/CVE-2021-41091
https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17
https://поддержка.нппкт.рф/bin/view/ОСнова/Обновления/2.9/
https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47
CWE
CWE-281
{
"CVSS 2.0": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
"CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb, Docker Inc., \u0410\u041e \"\u041d\u041f\u041f\u041a\u0422\"",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "10 (Debian GNU/Linux), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 1.7 (Astra Linux Special Edition), \u0434\u043e 20.10.9 (Docker), 4.7 (Astra Linux Special Edition), \u0434\u043e 2.9 (\u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0414\u043b\u044f Docker:\n\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558\n\n\u0414\u043b\u044f Debian:\n\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://security-tracker.debian.org/tracker/CVE-2021-41091\n\n\u0414\u043b\u044f \u041e\u0421 Astra Linux:\n\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 docker.io \u0434\u043e 24.0.2+astra14 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17\n\n\u0414\u043b\u044f \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f docker.io \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 20.10.5+dfsg1-1+deb11u2.osnova8\n\n\u0414\u043b\u044f Astra Linux Special Edition 4.7:\n\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 docker.io \u0434\u043e 24.0.2+ci1 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "09.09.2021",
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "27.04.2024",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "11.11.2023",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2023-07629",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2021-41091",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Debian GNU/Linux, Astra Linux Special Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), Docker, \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21165913)",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 10 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 12 , \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 1.7 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 4.7 ARM (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), \u0410\u041e \"\u041d\u041f\u041f\u041a\u0422\" \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx \u0434\u043e 2.9 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21165913)",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u0432 \u0441\u0440\u0435\u0434\u0430\u0445 \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0438\u0437\u0430\u0446\u0438\u0438 Docker, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u043c \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c, \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u0438\u0445 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439 (CWE-281)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u0432 \u0441\u0440\u0435\u0434\u0430\u0445 \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0438\u0437\u0430\u0446\u0438\u0438 Docker \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u043c \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c, \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u0438\u0445 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64\nhttps://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-41091\nhttps://security-tracker.debian.org/tracker/CVE-2021-41091\nhttps://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17\nhttps://\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430.\u043d\u043f\u043f\u043a\u0442.\u0440\u0444/bin/view/\u041e\u0421\u043d\u043e\u0432\u0430/\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f/2.9/\nhttps://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u041f\u041e \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0418\u0418",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-281",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,3)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,3)"
}
FKIE_CVE-2021-41091
Vulnerability from fkie_nvd - Published: 2021-10-04 21:15 - Updated: 2024-11-21 06:25
Severity ?
6.3 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
6.3 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
6.3 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Summary
Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.
References
| URL | Tags | ||
|---|---|---|---|
| security-advisories@github.com | https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf | ||
| security-advisories@github.com | https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64 | Patch, Third Party Advisory | |
| security-advisories@github.com | https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558 | Third Party Advisory | |
| security-advisories@github.com | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/ | ||
| security-advisories@github.com | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/ |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mobyproject | moby | * | |
| fedoraproject | fedora | 34 | |
| fedoraproject | fedora | 35 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83825875-76D7-4BB9-BB49-86568EBE67E9",
"versionEndExcluding": "20.10.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
"matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers."
},
{
"lang": "es",
"value": "Moby es un proyecto de c\u00f3digo abierto creado por Docker para permitir la contenci\u00f3n de software. Se encontr\u00f3 un error en Moby (Docker Engine) en el que el directorio de datos (normalmente \"/var/lib/docker\") conten\u00eda subdirectorios con permisos insuficientemente restringidos, lo que permit\u00eda a usuarios de Linux no privilegiados saltar el contenido del directorio y ejecutar programas. Cuando los contenedores inclu\u00edan programas ejecutables con bits de permiso extendidos (como \"setuid\"), los usuarios no privilegiados de Linux pod\u00edan detectar y ejecutar esos programas. Cuando el UID de un usuario de Linux no privilegiados en el host colisionaba con el propietario o el grupo de un archivo dentro de un contenedor, el usuario de Linux no privilegiados en el host pod\u00eda descubrir, leer y modificar esos archivos. Este bug ha sido corregido en Moby (Docker Engine) versi\u00f3n 20.10.9. Usuarios deber\u00edan actualizar a esta versi\u00f3n lo antes posible. Los contenedores en ejecuci\u00f3n deben ser detenidos y reiniciados para que los permisos sean corregidos. Para usuarios que no puedan actualizar, limite el acceso al host a usuarios confiables. Limite el acceso a los vol\u00famenes del host a los contenedores confiables"
}
],
"id": "CVE-2021-41091",
"lastModified": "2024-11-21T06:25:26.587",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.0,
"impactScore": 3.7,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.0,
"impactScore": 3.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-10-04T21:15:12.680",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64"
},
{
"source": "security-advisories@github.com",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558"
},
{
"source": "security-advisories@github.com",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/"
},
{
"source": "security-advisories@github.com",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-281"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-732"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-3FWX-PJGW-3558
Vulnerability from github – Published: 2024-01-31 23:28 – Updated: 2024-05-14 22:00
VLAI?
Summary
Moby (Docker Engine) Insufficiently restricted permissions on data directory
Details
Impact
A bug was found in Moby (Docker Engine) where the data directory (typically /var/lib/docker) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files.
Patches
This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed.
Workarounds
Limit access to the host to trusted users. Limit access to host volumes to trusted containers.
Credits
The Moby project would like to thank Joan Bruguera for responsibly disclosing this issue in accordance with the Moby security policy.
For more information
If you have any questions or comments about this advisory:
- Open an issue
- Email us at security@docker.com if you think you’ve found a security bug
Severity ?
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/moby/moby"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "20.10.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/docker/docker"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "20.10.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-41091"
],
"database_specific": {
"cwe_ids": [
"CWE-281",
"CWE-732"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-31T23:28:58Z",
"nvd_published_at": "2021-10-04T21:15:00Z",
"severity": "MODERATE"
},
"details": "## Impact\n\nA bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files.\n\n## Patches\n\nThis bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed.\n\n## Workarounds\n\nLimit access to the host to trusted users. Limit access to host volumes to trusted containers.\n\n## Credits\n\nThe Moby project would like to thank Joan Bruguera for responsibly disclosing this issue in accordance with the [Moby security policy](https://github.com/moby/moby/blob/master/SECURITY.md).\n\n## For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Open an issue](https://github.com/moby/moby/issues/new)\n* Email us at security@docker.com if you think you\u2019ve found a security bug",
"id": "GHSA-3fwx-pjgw-3558",
"modified": "2024-05-14T22:00:30Z",
"published": "2024-01-31T23:28:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41091"
},
{
"type": "WEB",
"url": "https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
},
{
"type": "PACKAGE",
"url": "https://github.com/moby/moby"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Moby (Docker Engine) Insufficiently restricted permissions on data directory"
}
GSD-2021-41091
Vulnerability from gsd - Updated: 2023-12-13 01:23Details
Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2021-41091",
"description": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.",
"id": "GSD-2021-41091",
"references": [
"https://www.suse.com/security/cve/CVE-2021-41091.html",
"https://access.redhat.com/errata/RHSA-2022:0735",
"https://advisories.mageia.org/CVE-2021-41091.html",
"https://security.archlinux.org/CVE-2021-41091",
"https://alas.aws.amazon.com/cve/html/CVE-2021-41091.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2021-41091"
],
"details": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.",
"id": "GSD-2021-41091",
"modified": "2023-12-13T01:23:26.947278Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-41091",
"STATE": "PUBLIC",
"TITLE": "Insufficiently restricted permissions on data directory in Docker Engine"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "moby",
"version": {
"version_data": [
{
"version_value": "\u003c 20.10.9"
}
]
}
}
]
},
"vendor_name": "moby"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-281: Improper Preservation of Permissions"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558",
"refsource": "CONFIRM",
"url": "https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558"
},
{
"name": "https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64",
"refsource": "MISC",
"url": "https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64"
},
{
"name": "FEDORA-2021-df975338d4",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/"
},
{
"name": "FEDORA-2021-b5a9a481a2",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
}
]
},
"source": {
"advisory": "GHSA-3fwx-pjgw-3558",
"discovery": "UNKNOWN"
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "20.10.9",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-41091"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-281"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64"
},
{
"name": "https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558"
},
{
"name": "FEDORA-2021-df975338d4",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/"
},
{
"name": "FEDORA-2021-b5a9a481a2",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf",
"refsource": "CONFIRM",
"tags": [],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.0,
"impactScore": 3.7
}
},
"lastModifiedDate": "2022-06-14T11:15Z",
"publishedDate": "2021-10-04T21:15Z"
}
}
}
ICSA-22-167-09
Vulnerability from csaf_cisa - Published: 2022-06-14 00:00 - Updated: 2022-06-14 00:00Summary
Siemens SCALANCE LPE9403 Third-Party Vulnerabilities
Notes
Summary: Multiple vulnerabilities in the third-party components CivetWeb, Docker, Linux Kernel and systemd could allow an attacker to impact SCALANCE LPE9403 confidentiality, integrity and availability.
Siemens has released an update for the SCALANCE LPE9403 and recommends to update to the latest version.
General Recommendations: As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use: Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.
Legal Notice: All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer: This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.
Critical infrastructure sectors: Multiple
Countries/areas deployed: Worldwide
Company headquarters location: Germany
Recommended Practices: CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices: Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices: Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices: When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices: CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices: CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices: CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices: Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
References
31 references
| URL | Category |
|---|---|
| https://cert-portal.siemens.com/productcert/csaf/… | self |
| https://cert-portal.siemens.com/productcert/txt/s… | self |
| https://cert-portal.siemens.com/productcert/pdf/s… | self |
| https://raw.githubusercontent.com/cisagov/CSAF/de… | self |
| https://www.cisa.gov/news-events/ics-advisories/i… | self |
| https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-… | external |
| https://www.cisa.gov/resources-tools/resources/ic… | external |
| https://www.cisa.gov/topics/industrial-control-systems | external |
| https://us-cert.cisa.gov/sites/default/files/reco… | external |
| https://www.cisa.gov/sites/default/files/publicat… | external |
| https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B | external |
| https://support.industry.siemens.com/cs/ww/en/vie… | |
| https://cert-portal.siemens.com/productcert/mitre… | |
| https://support.industry.siemens.com/cs/ww/en/vie… | |
| https://cert-portal.siemens.com/productcert/mitre… | |
| https://support.industry.siemens.com/cs/ww/en/vie… | |
| https://cert-portal.siemens.com/productcert/mitre… | |
| https://support.industry.siemens.com/cs/ww/en/vie… | |
| https://cert-portal.siemens.com/productcert/mitre… | |
| https://support.industry.siemens.com/cs/ww/en/vie… | |
| https://cert-portal.siemens.com/productcert/mitre… | |
| https://support.industry.siemens.com/cs/ww/en/vie… | |
| https://cert-portal.siemens.com/productcert/mitre… | |
| https://support.industry.siemens.com/cs/ww/en/vie… | |
| https://cert-portal.siemens.com/productcert/mitre… | |
| https://support.industry.siemens.com/cs/ww/en/vie… | |
| https://cert-portal.siemens.com/productcert/mitre… | |
| https://support.industry.siemens.com/cs/ww/en/vie… | |
| https://cert-portal.siemens.com/productcert/mitre… | |
| https://support.industry.siemens.com/cs/ww/en/vie… | |
| https://cert-portal.siemens.com/productcert/mitre… |
Acknowledgments
Siemens ProductCERT
{
"document": {
"acknowledgments": [
{
"organization": "Siemens ProductCERT",
"summary": "reporting these vulnerabilities to CISA."
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"notes": [
{
"category": "summary",
"text": "Multiple vulnerabilities in the third-party components CivetWeb, Docker, Linux Kernel and systemd could allow an attacker to impact SCALANCE LPE9403 confidentiality, integrity and availability.\n\nSiemens has released an update for the SCALANCE LPE9403 and recommends to update to the latest version.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "other",
"text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
"title": "Advisory Conversion Disclaimer"
},
{
"category": "other",
"text": "Multiple",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "other",
"contact_details": "central@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "SSA-222547: Third-Party Component Vulnerabilities in SCALANCE LPE9403 before V2.0 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-222547.json"
},
{
"category": "self",
"summary": "SSA-222547: Third-Party Component Vulnerabilities in SCALANCE LPE9403 before V2.0 - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-222547.txt"
},
{
"category": "self",
"summary": "SSA-222547: Third-Party Component Vulnerabilities in SCALANCE LPE9403 before V2.0 - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-22-167-09 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-167-09.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-22-167-09 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-167-09"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Siemens SCALANCE LPE9403 Third-Party Vulnerabilities",
"tracking": {
"current_release_date": "2022-06-14T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-22-167-09",
"initial_release_date": "2022-06-14T00:00:00.000000Z",
"revision_history": [
{
"date": "2022-06-14T00:00:00.000000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV2.0",
"product": {
"name": "SCALANCE LPE9403",
"product_id": "CSAFPID-0001",
"product_identification_helper": {
"model_numbers": [
"6GK5998-3GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE LPE9403"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-27304",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2020-27304 - SCALANCE LPE9403",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
},
{
"summary": "CVE-2020-27304 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-27304.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2020-27304"
},
{
"cve": "CVE-2021-20317",
"cwe": {
"id": "CWE-665",
"name": "Improper Initialization"
},
"notes": [
{
"category": "summary",
"text": "A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user privileges to cause a denial of service, slowing and eventually stopping the system while running OSP.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-20317 - SCALANCE LPE9403",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
},
{
"summary": "CVE-2021-20317 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-20317.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-20317"
},
{
"cve": "CVE-2021-33910",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "summary",
"text": "The use of alloca function with an uncontrolled size in function unit_name_path_escape allows a local attacker, able to mount a filesystem on a very long path, to crash systemd and the whole system by allocating a very large space in the stack.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-33910 - SCALANCE LPE9403",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
},
{
"summary": "CVE-2021-33910 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-33910.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-33910"
},
{
"cve": "CVE-2021-36221",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "A race condition vulnerability was found in Go. The incoming requests body weren\u0027t closed after the handler panic and as a consequence this could lead to ReverseProxy crash.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-36221 - SCALANCE LPE9403",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
},
{
"summary": "CVE-2021-36221 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-36221.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-36221"
},
{
"cve": "CVE-2021-39293",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "summary",
"text": "The fix for CVE-2021-33196 can be bypassed by crafted inputs. As a result, the NewReader and OpenReader functions in archive/zip can still cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-39293 - SCALANCE LPE9403",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
},
{
"summary": "CVE-2021-39293 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-39293.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-39293"
},
{
"cve": "CVE-2021-41089",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability was found in Moby (Docker Engine) where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permission changes for existing files in the host\u2019s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-41089 - SCALANCE LPE9403",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
},
{
"summary": "CVE-2021-41089 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-41089.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-41089"
},
{
"cve": "CVE-2021-41091",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability was found in Moby (Docker Engine) where the data directory (typically /var/lib/docker) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-41091 - SCALANCE LPE9403",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
},
{
"summary": "CVE-2021-41091 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-41091.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-41091"
},
{
"cve": "CVE-2021-41092",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability was found in the Docker CLI where running docker login my-private-registry.example.com with a misconfigured configuration file (typically ~/.docker/config.json) listing a credsStore or credHelpers that could not be executed would result in any provided credentials being sent to registry-1.docker.io rather than the intended private registry.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-41092 - SCALANCE LPE9403",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
},
{
"summary": "CVE-2021-41092 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-41092.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-41092"
},
{
"cve": "CVE-2021-41103",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-41103 - SCALANCE LPE9403",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
},
{
"summary": "CVE-2021-41103 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-41103.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-41103"
},
{
"cve": "CVE-2022-0847",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability was found in the way the \"flags\" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2022-0847 - SCALANCE LPE9403",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
},
{
"summary": "CVE-2022-0847 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2022-0847.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109811123/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-0847"
}
]
}
OPENSUSE-SU-2021:1404-1
Vulnerability from csaf_opensuse - Published: 2021-10-31 14:52 - Updated: 2021-10-31 14:52Summary
Security update for containerd, docker, runc
Severity
Important
Notes
Title of the patch: Security update for containerd, docker, runc
Description of the patch: This update for containerd, docker, runc fixes the following issues:
Docker was updated to 20.10.9-ce. (bsc#1191355)
See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md.
CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
container was updated to v1.4.11, to fix CVE-2021-41103. bsc#1191355
- CVE-2021-32760: Fixed that a archive package allows chmod of file outside of unpack target directory (bsc#1188282)
- Install systemd service file as well (bsc#1190826)
Update to runc v1.0.2. Upstream changelog is available from
https://github.com/opencontainers/runc/releases/tag/v1.0.2
* Fixed a failure to set CPU quota period in some cases on cgroup v1.
* Fixed the inability to start a container with the 'adding seccomp filter
rule for syscall ...' error, caused by redundant seccomp rules (i.e. those
that has action equal to the default one). Such redundant rules are now
skipped.
* Made release builds reproducible from now on.
* Fixed a rare debug log race in runc init, which can result in occasional
harmful 'failed to decode ...' errors from runc run or exec.
* Fixed the check in cgroup v1 systemd manager if a container needs to be
frozen before Set, and add a setting to skip such freeze unconditionally.
The previous fix for that issue, done in runc 1.0.1, was not working.
Update to runc v1.0.1. Upstream changelog is available from
https://github.com/opencontainers/runc/releases/tag/v1.0.1
* Fixed occasional runc exec/run failure ('interrupted system call') on an
Azure volume.
* Fixed 'unable to find groups ... token too long' error with /etc/group
containing lines longer than 64K characters.
* cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
frozen. This is a regression in 1.0.0, not affecting runc itself but some
of libcontainer users (e.g Kubernetes).
* cgroupv2: bpf: Ignore inaccessible existing programs in case of
permission error when handling replacement of existing bpf cgroup
programs. This fixes a regression in 1.0.0, where some SELinux
policies would block runc from being able to run entirely.
* cgroup/systemd/v2: don't freeze cgroup on Set.
* cgroup/systemd/v1: avoid unnecessary freeze on Set.
- fix issues with runc under openSUSE MicroOS's SELinux policy. bsc#1187704
Update to runc v1.0.0. Upstream changelog is available from
https://github.com/opencontainers/runc/releases/tag/v1.0.0
! The usage of relative paths for mountpoints will now produce a warning
(such configurations are outside of the spec, and in future runc will
produce an error when given such configurations).
* cgroupv2: devices: rework the filter generation to produce consistent
results with cgroupv1, and always clobber any existing eBPF
program(s) to fix runc update and avoid leaking eBPF programs
(resulting in errors when managing containers).
* cgroupv2: correctly convert 'number of IOs' statistics in a
cgroupv1-compatible way.
* cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
* cgroupv2: wait for freeze to finish before returning from the freezing
code, optimize the method for checking whether a cgroup is frozen.
* cgroups/systemd: fixed 'retry on dbus disconnect' logic introduced in rc94
* cgroups/systemd: fixed returning 'unit already exists' error from a systemd
cgroup manager (regression in rc94)
+ cgroupv2: support SkipDevices with systemd driver
+ cgroup/systemd: return, not ignore, stop unit error from Destroy
+ Make 'runc --version' output sane even when built with go get or
otherwise outside of our build scripts.
+ cgroups: set SkipDevices during runc update (so we don't modify
cgroups at all during runc update).
+ cgroup1: blkio: support BFQ weights.
+ cgroupv2: set per-device io weights if BFQ IO scheduler is available.
Update to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
This release of runc contains a fix for CVE-2021-30465, and users are
strongly recommended to update (especially if you are providing
semi-limited access to spawn containers to untrusted users). (bsc#1185405)
Update to runc v1.0.0~rc94. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
Breaking Changes:
* cgroupv1: kernel memory limits are now always ignored, as kmemcg has
been effectively deprecated by the kernel. Users should make use of regular
memory cgroup controls.
Regression Fixes:
* seccomp: fix 32-bit compilation errors
* runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
* runc start: fix 'chdir to cwd: permission denied' for some setups
This update was imported from the SUSE:SLE-15:Update update project.
Patchnames: openSUSE-2021-1404
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.4 (High)
Affected products
Recommended
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
low
Affected products
Recommended
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.3 (Medium)
Affected products
Recommended
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.4 (Medium)
Affected products
Recommended
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
37 references
| URL | Category |
|---|---|
| https://www.suse.com/support/security/rating/ | external |
| https://ftp.suse.com/pub/projects/security/csaf/o… | self |
| https://lists.opensuse.org/archives/list/security… | self |
| https://lists.opensuse.org/archives/list/security… | self |
| https://bugzilla.suse.com/1102408 | self |
| https://bugzilla.suse.com/1185405 | self |
| https://bugzilla.suse.com/1187704 | self |
| https://bugzilla.suse.com/1188282 | self |
| https://bugzilla.suse.com/1190826 | self |
| https://bugzilla.suse.com/1191015 | self |
| https://bugzilla.suse.com/1191121 | self |
| https://bugzilla.suse.com/1191334 | self |
| https://bugzilla.suse.com/1191355 | self |
| https://bugzilla.suse.com/1191434 | self |
| https://www.suse.com/security/cve/CVE-2021-30465/ | self |
| https://www.suse.com/security/cve/CVE-2021-32760/ | self |
| https://www.suse.com/security/cve/CVE-2021-41089/ | self |
| https://www.suse.com/security/cve/CVE-2021-41091/ | self |
| https://www.suse.com/security/cve/CVE-2021-41092/ | self |
| https://www.suse.com/security/cve/CVE-2021-41103/ | self |
| https://www.suse.com/security/cve/CVE-2021-30465 | external |
| https://bugzilla.suse.com/1185405 | external |
| https://bugzilla.suse.com/1189161 | external |
| https://www.suse.com/security/cve/CVE-2021-32760 | external |
| https://bugzilla.suse.com/1188282 | external |
| https://www.suse.com/security/cve/CVE-2021-41089 | external |
| https://bugzilla.suse.com/1191015 | external |
| https://bugzilla.suse.com/1191355 | external |
| https://www.suse.com/security/cve/CVE-2021-41091 | external |
| https://bugzilla.suse.com/1191355 | external |
| https://bugzilla.suse.com/1191434 | external |
| https://www.suse.com/security/cve/CVE-2021-41092 | external |
| https://bugzilla.suse.com/1191334 | external |
| https://bugzilla.suse.com/1191355 | external |
| https://www.suse.com/security/cve/CVE-2021-41103 | external |
| https://bugzilla.suse.com/1191121 | external |
| https://bugzilla.suse.com/1191355 | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for containerd, docker, runc",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for containerd, docker, runc fixes the following issues:\n\nDocker was updated to 20.10.9-ce. (bsc#1191355)\n\nSee upstream changelog in the packaged\n /usr/share/doc/packages/docker/CHANGELOG.md. \n\n CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103\n\ncontainer was updated to v1.4.11, to fix CVE-2021-41103. bsc#1191355\n\n- CVE-2021-32760: Fixed that a archive package allows chmod of file outside of unpack target directory (bsc#1188282)\n\n- Install systemd service file as well (bsc#1190826)\n\nUpdate to runc v1.0.2. Upstream changelog is available from\n\n https://github.com/opencontainers/runc/releases/tag/v1.0.2\n\n* Fixed a failure to set CPU quota period in some cases on cgroup v1.\n* Fixed the inability to start a container with the \u0027adding seccomp filter\n rule for syscall ...\u0027 error, caused by redundant seccomp rules (i.e. those\n that has action equal to the default one). Such redundant rules are now\n skipped.\n* Made release builds reproducible from now on.\n* Fixed a rare debug log race in runc init, which can result in occasional\n harmful \u0027failed to decode ...\u0027 errors from runc run or exec.\n* Fixed the check in cgroup v1 systemd manager if a container needs to be\n frozen before Set, and add a setting to skip such freeze unconditionally.\n The previous fix for that issue, done in runc 1.0.1, was not working.\n\nUpdate to runc v1.0.1. Upstream changelog is available from\n\nhttps://github.com/opencontainers/runc/releases/tag/v1.0.1\n\n* Fixed occasional runc exec/run failure (\u0027interrupted system call\u0027) on an\n Azure volume.\n* Fixed \u0027unable to find groups ... token too long\u0027 error with /etc/group\n containing lines longer than 64K characters.\n* cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is\n frozen. This is a regression in 1.0.0, not affecting runc itself but some\n of libcontainer users (e.g Kubernetes).\n* cgroupv2: bpf: Ignore inaccessible existing programs in case of\n permission error when handling replacement of existing bpf cgroup\n programs. This fixes a regression in 1.0.0, where some SELinux\n policies would block runc from being able to run entirely.\n* cgroup/systemd/v2: don\u0027t freeze cgroup on Set.\n* cgroup/systemd/v1: avoid unnecessary freeze on Set.\n- fix issues with runc under openSUSE MicroOS\u0027s SELinux policy. bsc#1187704\n\nUpdate to runc v1.0.0. Upstream changelog is available from\n\nhttps://github.com/opencontainers/runc/releases/tag/v1.0.0\n\n! The usage of relative paths for mountpoints will now produce a warning\n (such configurations are outside of the spec, and in future runc will\n produce an error when given such configurations).\n* cgroupv2: devices: rework the filter generation to produce consistent\n results with cgroupv1, and always clobber any existing eBPF\n program(s) to fix runc update and avoid leaking eBPF programs\n (resulting in errors when managing containers).\n* cgroupv2: correctly convert \u0027number of IOs\u0027 statistics in a\n cgroupv1-compatible way.\n* cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.\n* cgroupv2: wait for freeze to finish before returning from the freezing\n code, optimize the method for checking whether a cgroup is frozen.\n* cgroups/systemd: fixed \u0027retry on dbus disconnect\u0027 logic introduced in rc94\n* cgroups/systemd: fixed returning \u0027unit already exists\u0027 error from a systemd\n cgroup manager (regression in rc94)\n+ cgroupv2: support SkipDevices with systemd driver\n+ cgroup/systemd: return, not ignore, stop unit error from Destroy\n+ Make \u0027runc --version\u0027 output sane even when built with go get or\n otherwise outside of our build scripts.\n+ cgroups: set SkipDevices during runc update (so we don\u0027t modify\n cgroups at all during runc update).\n+ cgroup1: blkio: support BFQ weights.\n+ cgroupv2: set per-device io weights if BFQ IO scheduler is available.\n\nUpdate to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95\n\nThis release of runc contains a fix for CVE-2021-30465, and users are\nstrongly recommended to update (especially if you are providing\nsemi-limited access to spawn containers to untrusted users). (bsc#1185405)\n\nUpdate to runc v1.0.0~rc94. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94\n\nBreaking Changes:\n* cgroupv1: kernel memory limits are now always ignored, as kmemcg has\n been effectively deprecated by the kernel. Users should make use of regular\n memory cgroup controls.\n\nRegression Fixes:\n\n* seccomp: fix 32-bit compilation errors\n* runc init: fix a hang caused by deadlock in seccomp/ebpf loading code\n* runc start: fix \u0027chdir to cwd: permission denied\u0027 for some setups\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2021-1404",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_1404-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2021:1404-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/L7ADRJZ4HKOCVZC5ZKIM4MD6EZEHBNB3/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2021:1404-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/L7ADRJZ4HKOCVZC5ZKIM4MD6EZEHBNB3/"
},
{
"category": "self",
"summary": "SUSE Bug 1102408",
"url": "https://bugzilla.suse.com/1102408"
},
{
"category": "self",
"summary": "SUSE Bug 1185405",
"url": "https://bugzilla.suse.com/1185405"
},
{
"category": "self",
"summary": "SUSE Bug 1187704",
"url": "https://bugzilla.suse.com/1187704"
},
{
"category": "self",
"summary": "SUSE Bug 1188282",
"url": "https://bugzilla.suse.com/1188282"
},
{
"category": "self",
"summary": "SUSE Bug 1190826",
"url": "https://bugzilla.suse.com/1190826"
},
{
"category": "self",
"summary": "SUSE Bug 1191015",
"url": "https://bugzilla.suse.com/1191015"
},
{
"category": "self",
"summary": "SUSE Bug 1191121",
"url": "https://bugzilla.suse.com/1191121"
},
{
"category": "self",
"summary": "SUSE Bug 1191334",
"url": "https://bugzilla.suse.com/1191334"
},
{
"category": "self",
"summary": "SUSE Bug 1191355",
"url": "https://bugzilla.suse.com/1191355"
},
{
"category": "self",
"summary": "SUSE Bug 1191434",
"url": "https://bugzilla.suse.com/1191434"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-30465 page",
"url": "https://www.suse.com/security/cve/CVE-2021-30465/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-32760 page",
"url": "https://www.suse.com/security/cve/CVE-2021-32760/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-41089 page",
"url": "https://www.suse.com/security/cve/CVE-2021-41089/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-41091 page",
"url": "https://www.suse.com/security/cve/CVE-2021-41091/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-41092 page",
"url": "https://www.suse.com/security/cve/CVE-2021-41092/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-41103 page",
"url": "https://www.suse.com/security/cve/CVE-2021-41103/"
}
],
"title": "Security update for containerd, docker, runc",
"tracking": {
"current_release_date": "2021-10-31T14:52:54Z",
"generator": {
"date": "2021-10-31T14:52:54Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2021:1404-1",
"initial_release_date": "2021-10-31T14:52:54Z",
"revision_history": [
{
"date": "2021-10-31T14:52:54Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"product": {
"name": "docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"product_id": "docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch"
}
},
{
"category": "product_version",
"name": "docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"product": {
"name": "docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"product_id": "docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch"
}
},
{
"category": "product_version",
"name": "docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"product": {
"name": "docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"product_id": "docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "containerd-1.4.11-lp152.2.12.1.x86_64",
"product": {
"name": "containerd-1.4.11-lp152.2.12.1.x86_64",
"product_id": "containerd-1.4.11-lp152.2.12.1.x86_64"
}
},
{
"category": "product_version",
"name": "containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"product": {
"name": "containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"product_id": "containerd-ctr-1.4.11-lp152.2.12.1.x86_64"
}
},
{
"category": "product_version",
"name": "docker-20.10.9_ce-lp152.2.18.1.x86_64",
"product": {
"name": "docker-20.10.9_ce-lp152.2.18.1.x86_64",
"product_id": "docker-20.10.9_ce-lp152.2.18.1.x86_64"
}
},
{
"category": "product_version",
"name": "runc-1.0.2-lp152.2.9.1.x86_64",
"product": {
"name": "runc-1.0.2-lp152.2.9.1.x86_64",
"product_id": "runc-1.0.2-lp152.2.9.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.2",
"product": {
"name": "openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "containerd-1.4.11-lp152.2.12.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64"
},
"product_reference": "containerd-1.4.11-lp152.2.12.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "containerd-ctr-1.4.11-lp152.2.12.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64"
},
"product_reference": "containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-20.10.9_ce-lp152.2.18.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64"
},
"product_reference": "docker-20.10.9_ce-lp152.2.18.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch"
},
"product_reference": "docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch"
},
"product_reference": "docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch"
},
"product_reference": "docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-1.0.2-lp152.2.9.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
},
"product_reference": "runc-1.0.2-lp152.2.9.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-30465",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-30465"
}
],
"notes": [
{
"category": "general",
"text": "runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-30465",
"url": "https://www.suse.com/security/cve/CVE-2021-30465"
},
{
"category": "external",
"summary": "SUSE Bug 1185405 for CVE-2021-30465",
"url": "https://bugzilla.suse.com/1185405"
},
{
"category": "external",
"summary": "SUSE Bug 1189161 for CVE-2021-30465",
"url": "https://bugzilla.suse.com/1189161"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-10-31T14:52:54Z",
"details": "important"
}
],
"title": "CVE-2021-30465"
},
{
"cve": "CVE-2021-32760",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-32760"
}
],
"notes": [
{
"category": "general",
"text": "containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host\u0027s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-32760",
"url": "https://www.suse.com/security/cve/CVE-2021-32760"
},
{
"category": "external",
"summary": "SUSE Bug 1188282 for CVE-2021-32760",
"url": "https://bugzilla.suse.com/1188282"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-10-31T14:52:54Z",
"details": "low"
}
],
"title": "CVE-2021-32760"
},
{
"cve": "CVE-2021-41089",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-41089"
}
],
"notes": [
{
"category": "general",
"text": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host\u0027s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-41089",
"url": "https://www.suse.com/security/cve/CVE-2021-41089"
},
{
"category": "external",
"summary": "SUSE Bug 1191015 for CVE-2021-41089",
"url": "https://bugzilla.suse.com/1191015"
},
{
"category": "external",
"summary": "SUSE Bug 1191355 for CVE-2021-41089",
"url": "https://bugzilla.suse.com/1191355"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.6,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-10-31T14:52:54Z",
"details": "moderate"
}
],
"title": "CVE-2021-41089"
},
{
"cve": "CVE-2021-41091",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-41091"
}
],
"notes": [
{
"category": "general",
"text": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-41091",
"url": "https://www.suse.com/security/cve/CVE-2021-41091"
},
{
"category": "external",
"summary": "SUSE Bug 1191355 for CVE-2021-41091",
"url": "https://bugzilla.suse.com/1191355"
},
{
"category": "external",
"summary": "SUSE Bug 1191434 for CVE-2021-41091",
"url": "https://bugzilla.suse.com/1191434"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-10-31T14:52:54Z",
"details": "moderate"
}
],
"title": "CVE-2021-41091"
},
{
"cve": "CVE-2021-41092",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-41092"
}
],
"notes": [
{
"category": "general",
"text": "Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-41092",
"url": "https://www.suse.com/security/cve/CVE-2021-41092"
},
{
"category": "external",
"summary": "SUSE Bug 1191334 for CVE-2021-41092",
"url": "https://bugzilla.suse.com/1191334"
},
{
"category": "external",
"summary": "SUSE Bug 1191355 for CVE-2021-41092",
"url": "https://bugzilla.suse.com/1191355"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-10-31T14:52:54Z",
"details": "moderate"
}
],
"title": "CVE-2021-41092"
},
{
"cve": "CVE-2021-41103",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-41103"
}
],
"notes": [
{
"category": "general",
"text": "containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability. Users unable to update should limit access to the host to trusted users. Update directory permission on container bundles directories.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-41103",
"url": "https://www.suse.com/security/cve/CVE-2021-41103"
},
{
"category": "external",
"summary": "SUSE Bug 1191121 for CVE-2021-41103",
"url": "https://bugzilla.suse.com/1191121"
},
{
"category": "external",
"summary": "SUSE Bug 1191355 for CVE-2021-41103",
"url": "https://bugzilla.suse.com/1191355"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:containerd-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:containerd-ctr-1.4.11-lp152.2.12.1.x86_64",
"openSUSE Leap 15.2:docker-20.10.9_ce-lp152.2.18.1.x86_64",
"openSUSE Leap 15.2:docker-bash-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-fish-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:docker-zsh-completion-20.10.9_ce-lp152.2.18.1.noarch",
"openSUSE Leap 15.2:runc-1.0.2-lp152.2.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-10-31T14:52:54Z",
"details": "moderate"
}
],
"title": "CVE-2021-41103"
}
]
}
OPENSUSE-SU-2021:3506-1
Vulnerability from csaf_opensuse - Published: 2021-10-25 08:20 - Updated: 2021-10-25 08:20Summary
Security update for containerd, docker, runc
Severity
Important
Notes
Title of the patch: Security update for containerd, docker, runc
Description of the patch: This update for containerd, docker, runc fixes the following issues:
Docker was updated to 20.10.9-ce. (bsc#1191355)
See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md.
CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
container was updated to v1.4.11, to fix CVE-2021-41103. bsc#1191355
- CVE-2021-32760: Fixed that a archive package allows chmod of file outside of unpack target directory (bsc#1188282)
- Install systemd service file as well (bsc#1190826)
Update to runc v1.0.2. Upstream changelog is available from
https://github.com/opencontainers/runc/releases/tag/v1.0.2
* Fixed a failure to set CPU quota period in some cases on cgroup v1.
* Fixed the inability to start a container with the 'adding seccomp filter
rule for syscall ...' error, caused by redundant seccomp rules (i.e. those
that has action equal to the default one). Such redundant rules are now
skipped.
* Made release builds reproducible from now on.
* Fixed a rare debug log race in runc init, which can result in occasional
harmful 'failed to decode ...' errors from runc run or exec.
* Fixed the check in cgroup v1 systemd manager if a container needs to be
frozen before Set, and add a setting to skip such freeze unconditionally.
The previous fix for that issue, done in runc 1.0.1, was not working.
Update to runc v1.0.1. Upstream changelog is available from
https://github.com/opencontainers/runc/releases/tag/v1.0.1
* Fixed occasional runc exec/run failure ('interrupted system call') on an
Azure volume.
* Fixed 'unable to find groups ... token too long' error with /etc/group
containing lines longer than 64K characters.
* cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
frozen. This is a regression in 1.0.0, not affecting runc itself but some
of libcontainer users (e.g Kubernetes).
* cgroupv2: bpf: Ignore inaccessible existing programs in case of
permission error when handling replacement of existing bpf cgroup
programs. This fixes a regression in 1.0.0, where some SELinux
policies would block runc from being able to run entirely.
* cgroup/systemd/v2: don't freeze cgroup on Set.
* cgroup/systemd/v1: avoid unnecessary freeze on Set.
- fix issues with runc under openSUSE MicroOS's SELinux policy. bsc#1187704
Update to runc v1.0.0. Upstream changelog is available from
https://github.com/opencontainers/runc/releases/tag/v1.0.0
! The usage of relative paths for mountpoints will now produce a warning
(such configurations are outside of the spec, and in future runc will
produce an error when given such configurations).
* cgroupv2: devices: rework the filter generation to produce consistent
results with cgroupv1, and always clobber any existing eBPF
program(s) to fix runc update and avoid leaking eBPF programs
(resulting in errors when managing containers).
* cgroupv2: correctly convert 'number of IOs' statistics in a
cgroupv1-compatible way.
* cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
* cgroupv2: wait for freeze to finish before returning from the freezing
code, optimize the method for checking whether a cgroup is frozen.
* cgroups/systemd: fixed 'retry on dbus disconnect' logic introduced in rc94
* cgroups/systemd: fixed returning 'unit already exists' error from a systemd
cgroup manager (regression in rc94)
+ cgroupv2: support SkipDevices with systemd driver
+ cgroup/systemd: return, not ignore, stop unit error from Destroy
+ Make 'runc --version' output sane even when built with go get or
otherwise outside of our build scripts.
+ cgroups: set SkipDevices during runc update (so we don't modify
cgroups at all during runc update).
+ cgroup1: blkio: support BFQ weights.
+ cgroupv2: set per-device io weights if BFQ IO scheduler is available.
Update to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
This release of runc contains a fix for CVE-2021-30465, and users are
strongly recommended to update (especially if you are providing
semi-limited access to spawn containers to untrusted users). (bsc#1185405)
Update to runc v1.0.0~rc94. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
Breaking Changes:
* cgroupv1: kernel memory limits are now always ignored, as kmemcg has
been effectively deprecated by the kernel. Users should make use of regular
memory cgroup controls.
Regression Fixes:
* seccomp: fix 32-bit compilation errors
* runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
* runc start: fix 'chdir to cwd: permission denied' for some setups
Patchnames: openSUSE-SLE-15.3-2021-3506
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.4 (High)
Affected products
Recommended
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
low
Affected products
Recommended
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.3 (Medium)
Affected products
Recommended
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.4 (Medium)
Affected products
Recommended
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
37 references
| URL | Category |
|---|---|
| https://www.suse.com/support/security/rating/ | external |
| https://ftp.suse.com/pub/projects/security/csaf/o… | self |
| https://lists.opensuse.org/archives/list/security… | self |
| https://lists.opensuse.org/archives/list/security… | self |
| https://bugzilla.suse.com/1102408 | self |
| https://bugzilla.suse.com/1185405 | self |
| https://bugzilla.suse.com/1187704 | self |
| https://bugzilla.suse.com/1188282 | self |
| https://bugzilla.suse.com/1190826 | self |
| https://bugzilla.suse.com/1191015 | self |
| https://bugzilla.suse.com/1191121 | self |
| https://bugzilla.suse.com/1191334 | self |
| https://bugzilla.suse.com/1191355 | self |
| https://bugzilla.suse.com/1191434 | self |
| https://www.suse.com/security/cve/CVE-2021-30465/ | self |
| https://www.suse.com/security/cve/CVE-2021-32760/ | self |
| https://www.suse.com/security/cve/CVE-2021-41089/ | self |
| https://www.suse.com/security/cve/CVE-2021-41091/ | self |
| https://www.suse.com/security/cve/CVE-2021-41092/ | self |
| https://www.suse.com/security/cve/CVE-2021-41103/ | self |
| https://www.suse.com/security/cve/CVE-2021-30465 | external |
| https://bugzilla.suse.com/1185405 | external |
| https://bugzilla.suse.com/1189161 | external |
| https://www.suse.com/security/cve/CVE-2021-32760 | external |
| https://bugzilla.suse.com/1188282 | external |
| https://www.suse.com/security/cve/CVE-2021-41089 | external |
| https://bugzilla.suse.com/1191015 | external |
| https://bugzilla.suse.com/1191355 | external |
| https://www.suse.com/security/cve/CVE-2021-41091 | external |
| https://bugzilla.suse.com/1191355 | external |
| https://bugzilla.suse.com/1191434 | external |
| https://www.suse.com/security/cve/CVE-2021-41092 | external |
| https://bugzilla.suse.com/1191334 | external |
| https://bugzilla.suse.com/1191355 | external |
| https://www.suse.com/security/cve/CVE-2021-41103 | external |
| https://bugzilla.suse.com/1191121 | external |
| https://bugzilla.suse.com/1191355 | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for containerd, docker, runc",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for containerd, docker, runc fixes the following issues:\n\nDocker was updated to 20.10.9-ce. (bsc#1191355)\n\nSee upstream changelog in the packaged\n /usr/share/doc/packages/docker/CHANGELOG.md. \n\n CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103\n\ncontainer was updated to v1.4.11, to fix CVE-2021-41103. bsc#1191355\n\n- CVE-2021-32760: Fixed that a archive package allows chmod of file outside of unpack target directory (bsc#1188282)\n\n- Install systemd service file as well (bsc#1190826)\n\nUpdate to runc v1.0.2. Upstream changelog is available from\n\n https://github.com/opencontainers/runc/releases/tag/v1.0.2\n\n* Fixed a failure to set CPU quota period in some cases on cgroup v1.\n* Fixed the inability to start a container with the \u0027adding seccomp filter\n rule for syscall ...\u0027 error, caused by redundant seccomp rules (i.e. those\n that has action equal to the default one). Such redundant rules are now\n skipped.\n* Made release builds reproducible from now on.\n* Fixed a rare debug log race in runc init, which can result in occasional\n harmful \u0027failed to decode ...\u0027 errors from runc run or exec.\n* Fixed the check in cgroup v1 systemd manager if a container needs to be\n frozen before Set, and add a setting to skip such freeze unconditionally.\n The previous fix for that issue, done in runc 1.0.1, was not working.\n\nUpdate to runc v1.0.1. Upstream changelog is available from\n\nhttps://github.com/opencontainers/runc/releases/tag/v1.0.1\n\n* Fixed occasional runc exec/run failure (\u0027interrupted system call\u0027) on an\n Azure volume.\n* Fixed \u0027unable to find groups ... token too long\u0027 error with /etc/group\n containing lines longer than 64K characters.\n* cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is\n frozen. This is a regression in 1.0.0, not affecting runc itself but some\n of libcontainer users (e.g Kubernetes).\n* cgroupv2: bpf: Ignore inaccessible existing programs in case of\n permission error when handling replacement of existing bpf cgroup\n programs. This fixes a regression in 1.0.0, where some SELinux\n policies would block runc from being able to run entirely.\n* cgroup/systemd/v2: don\u0027t freeze cgroup on Set.\n* cgroup/systemd/v1: avoid unnecessary freeze on Set.\n- fix issues with runc under openSUSE MicroOS\u0027s SELinux policy. bsc#1187704\n\nUpdate to runc v1.0.0. Upstream changelog is available from\n\nhttps://github.com/opencontainers/runc/releases/tag/v1.0.0\n\n! The usage of relative paths for mountpoints will now produce a warning\n (such configurations are outside of the spec, and in future runc will\n produce an error when given such configurations).\n* cgroupv2: devices: rework the filter generation to produce consistent\n results with cgroupv1, and always clobber any existing eBPF\n program(s) to fix runc update and avoid leaking eBPF programs\n (resulting in errors when managing containers).\n* cgroupv2: correctly convert \u0027number of IOs\u0027 statistics in a\n cgroupv1-compatible way.\n* cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.\n* cgroupv2: wait for freeze to finish before returning from the freezing\n code, optimize the method for checking whether a cgroup is frozen.\n* cgroups/systemd: fixed \u0027retry on dbus disconnect\u0027 logic introduced in rc94\n* cgroups/systemd: fixed returning \u0027unit already exists\u0027 error from a systemd\n cgroup manager (regression in rc94)\n+ cgroupv2: support SkipDevices with systemd driver\n+ cgroup/systemd: return, not ignore, stop unit error from Destroy\n+ Make \u0027runc --version\u0027 output sane even when built with go get or\n otherwise outside of our build scripts.\n+ cgroups: set SkipDevices during runc update (so we don\u0027t modify\n cgroups at all during runc update).\n+ cgroup1: blkio: support BFQ weights.\n+ cgroupv2: set per-device io weights if BFQ IO scheduler is available.\n\nUpdate to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95\n\nThis release of runc contains a fix for CVE-2021-30465, and users are\nstrongly recommended to update (especially if you are providing\nsemi-limited access to spawn containers to untrusted users). (bsc#1185405)\n\nUpdate to runc v1.0.0~rc94. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94\n\nBreaking Changes:\n* cgroupv1: kernel memory limits are now always ignored, as kmemcg has\n been effectively deprecated by the kernel. Users should make use of regular\n memory cgroup controls.\n\nRegression Fixes:\n\n* seccomp: fix 32-bit compilation errors\n* runc init: fix a hang caused by deadlock in seccomp/ebpf loading code\n* runc start: fix \u0027chdir to cwd: permission denied\u0027 for some setups\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-SLE-15.3-2021-3506",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_3506-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2021:3506-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NP4XGHFKECRFSI6UYXER53KXVGP66EHQ/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2021:3506-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NP4XGHFKECRFSI6UYXER53KXVGP66EHQ/"
},
{
"category": "self",
"summary": "SUSE Bug 1102408",
"url": "https://bugzilla.suse.com/1102408"
},
{
"category": "self",
"summary": "SUSE Bug 1185405",
"url": "https://bugzilla.suse.com/1185405"
},
{
"category": "self",
"summary": "SUSE Bug 1187704",
"url": "https://bugzilla.suse.com/1187704"
},
{
"category": "self",
"summary": "SUSE Bug 1188282",
"url": "https://bugzilla.suse.com/1188282"
},
{
"category": "self",
"summary": "SUSE Bug 1190826",
"url": "https://bugzilla.suse.com/1190826"
},
{
"category": "self",
"summary": "SUSE Bug 1191015",
"url": "https://bugzilla.suse.com/1191015"
},
{
"category": "self",
"summary": "SUSE Bug 1191121",
"url": "https://bugzilla.suse.com/1191121"
},
{
"category": "self",
"summary": "SUSE Bug 1191334",
"url": "https://bugzilla.suse.com/1191334"
},
{
"category": "self",
"summary": "SUSE Bug 1191355",
"url": "https://bugzilla.suse.com/1191355"
},
{
"category": "self",
"summary": "SUSE Bug 1191434",
"url": "https://bugzilla.suse.com/1191434"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-30465 page",
"url": "https://www.suse.com/security/cve/CVE-2021-30465/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-32760 page",
"url": "https://www.suse.com/security/cve/CVE-2021-32760/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-41089 page",
"url": "https://www.suse.com/security/cve/CVE-2021-41089/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-41091 page",
"url": "https://www.suse.com/security/cve/CVE-2021-41091/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-41092 page",
"url": "https://www.suse.com/security/cve/CVE-2021-41092/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-41103 page",
"url": "https://www.suse.com/security/cve/CVE-2021-41103/"
}
],
"title": "Security update for containerd, docker, runc",
"tracking": {
"current_release_date": "2021-10-25T08:20:48Z",
"generator": {
"date": "2021-10-25T08:20:48Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2021:3506-1",
"initial_release_date": "2021-10-25T08:20:48Z",
"revision_history": [
{
"date": "2021-10-25T08:20:48Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "containerd-1.4.11-56.1.aarch64",
"product": {
"name": "containerd-1.4.11-56.1.aarch64",
"product_id": "containerd-1.4.11-56.1.aarch64"
}
},
{
"category": "product_version",
"name": "containerd-ctr-1.4.11-56.1.aarch64",
"product": {
"name": "containerd-ctr-1.4.11-56.1.aarch64",
"product_id": "containerd-ctr-1.4.11-56.1.aarch64"
}
},
{
"category": "product_version",
"name": "docker-20.10.9_ce-156.1.aarch64",
"product": {
"name": "docker-20.10.9_ce-156.1.aarch64",
"product_id": "docker-20.10.9_ce-156.1.aarch64"
}
},
{
"category": "product_version",
"name": "docker-kubic-20.10.9_ce-156.1.aarch64",
"product": {
"name": "docker-kubic-20.10.9_ce-156.1.aarch64",
"product_id": "docker-kubic-20.10.9_ce-156.1.aarch64"
}
},
{
"category": "product_version",
"name": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"product": {
"name": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"product_id": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64"
}
},
{
"category": "product_version",
"name": "runc-1.0.2-23.1.aarch64",
"product": {
"name": "runc-1.0.2-23.1.aarch64",
"product_id": "runc-1.0.2-23.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "docker-bash-completion-20.10.9_ce-156.1.noarch",
"product": {
"name": "docker-bash-completion-20.10.9_ce-156.1.noarch",
"product_id": "docker-bash-completion-20.10.9_ce-156.1.noarch"
}
},
{
"category": "product_version",
"name": "docker-fish-completion-20.10.9_ce-156.1.noarch",
"product": {
"name": "docker-fish-completion-20.10.9_ce-156.1.noarch",
"product_id": "docker-fish-completion-20.10.9_ce-156.1.noarch"
}
},
{
"category": "product_version",
"name": "docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"product": {
"name": "docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"product_id": "docker-kubic-bash-completion-20.10.9_ce-156.1.noarch"
}
},
{
"category": "product_version",
"name": "docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"product": {
"name": "docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"product_id": "docker-kubic-fish-completion-20.10.9_ce-156.1.noarch"
}
},
{
"category": "product_version",
"name": "docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"product": {
"name": "docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"product_id": "docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch"
}
},
{
"category": "product_version",
"name": "docker-zsh-completion-20.10.9_ce-156.1.noarch",
"product": {
"name": "docker-zsh-completion-20.10.9_ce-156.1.noarch",
"product_id": "docker-zsh-completion-20.10.9_ce-156.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "containerd-1.4.11-56.1.ppc64le",
"product": {
"name": "containerd-1.4.11-56.1.ppc64le",
"product_id": "containerd-1.4.11-56.1.ppc64le"
}
},
{
"category": "product_version",
"name": "containerd-ctr-1.4.11-56.1.ppc64le",
"product": {
"name": "containerd-ctr-1.4.11-56.1.ppc64le",
"product_id": "containerd-ctr-1.4.11-56.1.ppc64le"
}
},
{
"category": "product_version",
"name": "docker-20.10.9_ce-156.1.ppc64le",
"product": {
"name": "docker-20.10.9_ce-156.1.ppc64le",
"product_id": "docker-20.10.9_ce-156.1.ppc64le"
}
},
{
"category": "product_version",
"name": "docker-kubic-20.10.9_ce-156.1.ppc64le",
"product": {
"name": "docker-kubic-20.10.9_ce-156.1.ppc64le",
"product_id": "docker-kubic-20.10.9_ce-156.1.ppc64le"
}
},
{
"category": "product_version",
"name": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"product": {
"name": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"product_id": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le"
}
},
{
"category": "product_version",
"name": "runc-1.0.2-23.1.ppc64le",
"product": {
"name": "runc-1.0.2-23.1.ppc64le",
"product_id": "runc-1.0.2-23.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "containerd-1.4.11-56.1.s390x",
"product": {
"name": "containerd-1.4.11-56.1.s390x",
"product_id": "containerd-1.4.11-56.1.s390x"
}
},
{
"category": "product_version",
"name": "containerd-ctr-1.4.11-56.1.s390x",
"product": {
"name": "containerd-ctr-1.4.11-56.1.s390x",
"product_id": "containerd-ctr-1.4.11-56.1.s390x"
}
},
{
"category": "product_version",
"name": "docker-20.10.9_ce-156.1.s390x",
"product": {
"name": "docker-20.10.9_ce-156.1.s390x",
"product_id": "docker-20.10.9_ce-156.1.s390x"
}
},
{
"category": "product_version",
"name": "docker-kubic-20.10.9_ce-156.1.s390x",
"product": {
"name": "docker-kubic-20.10.9_ce-156.1.s390x",
"product_id": "docker-kubic-20.10.9_ce-156.1.s390x"
}
},
{
"category": "product_version",
"name": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"product": {
"name": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"product_id": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x"
}
},
{
"category": "product_version",
"name": "runc-1.0.2-23.1.s390x",
"product": {
"name": "runc-1.0.2-23.1.s390x",
"product_id": "runc-1.0.2-23.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "containerd-1.4.11-56.1.x86_64",
"product": {
"name": "containerd-1.4.11-56.1.x86_64",
"product_id": "containerd-1.4.11-56.1.x86_64"
}
},
{
"category": "product_version",
"name": "containerd-ctr-1.4.11-56.1.x86_64",
"product": {
"name": "containerd-ctr-1.4.11-56.1.x86_64",
"product_id": "containerd-ctr-1.4.11-56.1.x86_64"
}
},
{
"category": "product_version",
"name": "docker-20.10.9_ce-156.1.x86_64",
"product": {
"name": "docker-20.10.9_ce-156.1.x86_64",
"product_id": "docker-20.10.9_ce-156.1.x86_64"
}
},
{
"category": "product_version",
"name": "docker-kubic-20.10.9_ce-156.1.x86_64",
"product": {
"name": "docker-kubic-20.10.9_ce-156.1.x86_64",
"product_id": "docker-kubic-20.10.9_ce-156.1.x86_64"
}
},
{
"category": "product_version",
"name": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"product": {
"name": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"product_id": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64"
}
},
{
"category": "product_version",
"name": "runc-1.0.2-23.1.x86_64",
"product": {
"name": "runc-1.0.2-23.1.x86_64",
"product_id": "runc-1.0.2-23.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.3",
"product": {
"name": "openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.3"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "containerd-1.4.11-56.1.aarch64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64"
},
"product_reference": "containerd-1.4.11-56.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "containerd-1.4.11-56.1.ppc64le as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le"
},
"product_reference": "containerd-1.4.11-56.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "containerd-1.4.11-56.1.s390x as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x"
},
"product_reference": "containerd-1.4.11-56.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "containerd-1.4.11-56.1.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64"
},
"product_reference": "containerd-1.4.11-56.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "containerd-ctr-1.4.11-56.1.aarch64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64"
},
"product_reference": "containerd-ctr-1.4.11-56.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "containerd-ctr-1.4.11-56.1.ppc64le as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le"
},
"product_reference": "containerd-ctr-1.4.11-56.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "containerd-ctr-1.4.11-56.1.s390x as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x"
},
"product_reference": "containerd-ctr-1.4.11-56.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "containerd-ctr-1.4.11-56.1.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64"
},
"product_reference": "containerd-ctr-1.4.11-56.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-20.10.9_ce-156.1.aarch64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64"
},
"product_reference": "docker-20.10.9_ce-156.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-20.10.9_ce-156.1.ppc64le as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le"
},
"product_reference": "docker-20.10.9_ce-156.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-20.10.9_ce-156.1.s390x as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x"
},
"product_reference": "docker-20.10.9_ce-156.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-20.10.9_ce-156.1.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64"
},
"product_reference": "docker-20.10.9_ce-156.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-bash-completion-20.10.9_ce-156.1.noarch as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch"
},
"product_reference": "docker-bash-completion-20.10.9_ce-156.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-fish-completion-20.10.9_ce-156.1.noarch as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch"
},
"product_reference": "docker-fish-completion-20.10.9_ce-156.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-kubic-20.10.9_ce-156.1.aarch64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64"
},
"product_reference": "docker-kubic-20.10.9_ce-156.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-kubic-20.10.9_ce-156.1.ppc64le as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le"
},
"product_reference": "docker-kubic-20.10.9_ce-156.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-kubic-20.10.9_ce-156.1.s390x as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x"
},
"product_reference": "docker-kubic-20.10.9_ce-156.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-kubic-20.10.9_ce-156.1.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64"
},
"product_reference": "docker-kubic-20.10.9_ce-156.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-kubic-bash-completion-20.10.9_ce-156.1.noarch as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch"
},
"product_reference": "docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-kubic-fish-completion-20.10.9_ce-156.1.noarch as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch"
},
"product_reference": "docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64"
},
"product_reference": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le"
},
"product_reference": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x"
},
"product_reference": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64"
},
"product_reference": "docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch"
},
"product_reference": "docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-zsh-completion-20.10.9_ce-156.1.noarch as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch"
},
"product_reference": "docker-zsh-completion-20.10.9_ce-156.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-1.0.2-23.1.aarch64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64"
},
"product_reference": "runc-1.0.2-23.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-1.0.2-23.1.ppc64le as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le"
},
"product_reference": "runc-1.0.2-23.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-1.0.2-23.1.s390x as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:runc-1.0.2-23.1.s390x"
},
"product_reference": "runc-1.0.2-23.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-1.0.2-23.1.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
},
"product_reference": "runc-1.0.2-23.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-30465",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-30465"
}
],
"notes": [
{
"category": "general",
"text": "runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-30465",
"url": "https://www.suse.com/security/cve/CVE-2021-30465"
},
{
"category": "external",
"summary": "SUSE Bug 1185405 for CVE-2021-30465",
"url": "https://bugzilla.suse.com/1185405"
},
{
"category": "external",
"summary": "SUSE Bug 1189161 for CVE-2021-30465",
"url": "https://bugzilla.suse.com/1189161"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-10-25T08:20:48Z",
"details": "important"
}
],
"title": "CVE-2021-30465"
},
{
"cve": "CVE-2021-32760",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-32760"
}
],
"notes": [
{
"category": "general",
"text": "containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host\u0027s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-32760",
"url": "https://www.suse.com/security/cve/CVE-2021-32760"
},
{
"category": "external",
"summary": "SUSE Bug 1188282 for CVE-2021-32760",
"url": "https://bugzilla.suse.com/1188282"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-10-25T08:20:48Z",
"details": "low"
}
],
"title": "CVE-2021-32760"
},
{
"cve": "CVE-2021-41089",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-41089"
}
],
"notes": [
{
"category": "general",
"text": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host\u0027s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-41089",
"url": "https://www.suse.com/security/cve/CVE-2021-41089"
},
{
"category": "external",
"summary": "SUSE Bug 1191015 for CVE-2021-41089",
"url": "https://bugzilla.suse.com/1191015"
},
{
"category": "external",
"summary": "SUSE Bug 1191355 for CVE-2021-41089",
"url": "https://bugzilla.suse.com/1191355"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.6,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-10-25T08:20:48Z",
"details": "moderate"
}
],
"title": "CVE-2021-41089"
},
{
"cve": "CVE-2021-41091",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-41091"
}
],
"notes": [
{
"category": "general",
"text": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-41091",
"url": "https://www.suse.com/security/cve/CVE-2021-41091"
},
{
"category": "external",
"summary": "SUSE Bug 1191355 for CVE-2021-41091",
"url": "https://bugzilla.suse.com/1191355"
},
{
"category": "external",
"summary": "SUSE Bug 1191434 for CVE-2021-41091",
"url": "https://bugzilla.suse.com/1191434"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-10-25T08:20:48Z",
"details": "moderate"
}
],
"title": "CVE-2021-41091"
},
{
"cve": "CVE-2021-41092",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-41092"
}
],
"notes": [
{
"category": "general",
"text": "Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-41092",
"url": "https://www.suse.com/security/cve/CVE-2021-41092"
},
{
"category": "external",
"summary": "SUSE Bug 1191334 for CVE-2021-41092",
"url": "https://bugzilla.suse.com/1191334"
},
{
"category": "external",
"summary": "SUSE Bug 1191355 for CVE-2021-41092",
"url": "https://bugzilla.suse.com/1191355"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-10-25T08:20:48Z",
"details": "moderate"
}
],
"title": "CVE-2021-41092"
},
{
"cve": "CVE-2021-41103",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-41103"
}
],
"notes": [
{
"category": "general",
"text": "containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability. Users unable to update should limit access to the host to trusted users. Update directory permission on container bundles directories.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-41103",
"url": "https://www.suse.com/security/cve/CVE-2021-41103"
},
{
"category": "external",
"summary": "SUSE Bug 1191121 for CVE-2021-41103",
"url": "https://bugzilla.suse.com/1191121"
},
{
"category": "external",
"summary": "SUSE Bug 1191355 for CVE-2021-41103",
"url": "https://bugzilla.suse.com/1191355"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:containerd-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.aarch64",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.ppc64le",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.s390x",
"openSUSE Leap 15.3:containerd-ctr-1.4.11-56.1.x86_64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-bash-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-fish-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.aarch64",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.ppc64le",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.s390x",
"openSUSE Leap 15.3:docker-kubic-kubeadm-criconfig-20.10.9_ce-156.1.x86_64",
"openSUSE Leap 15.3:docker-kubic-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:docker-zsh-completion-20.10.9_ce-156.1.noarch",
"openSUSE Leap 15.3:runc-1.0.2-23.1.aarch64",
"openSUSE Leap 15.3:runc-1.0.2-23.1.ppc64le",
"openSUSE Leap 15.3:runc-1.0.2-23.1.s390x",
"openSUSE Leap 15.3:runc-1.0.2-23.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-10-25T08:20:48Z",
"details": "moderate"
}
],
"title": "CVE-2021-41103"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…