Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2021-44228 (GCVE-0-2021-44228)
Vulnerability from cvelistv5 – Published: 2021-12-10 00:00 – Updated: 2025-10-21 23:25| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Log4j2 |
Affected:
2.0-beta9 , < log4j-core*
(custom)
|
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
Exploited: Yes
Timestamps
Scope
Evidence
Type: Vendor Report
Signal: Successful Exploitation
Confidence: 80%
Source: cisa-kev
Details
| Cwes | CWE-20 CWE-400 CWE-502 |
|---|---|
| Feed | CISA Known Exploited Vulnerabilities Catalog |
| Product | Log4j2 |
| Due Date | 2021-12-24 |
| Date Added | 2021-12-10 |
| Vendorproject | Apache |
| Vulnerabilityname | Apache Log4j2 Remote Code Execution Vulnerability |
| Knownransomwarecampaignuse | Known |
References
Shadowserver
Known Exploited Vulnerability - GCVE BCP-07 Compliant
Exploited: Yes
Characteristics
Timestamps
Scope
Evidence
Type: Honeypot
Signal: In The Wild Attempts
Confidence: 70%
Source: shadowserver
Details
| 1D | 41 |
|---|---|
| Iot | no |
| Feed | Shadowserver Foundation honeypot/exploited-vulnerabilities |
| Type | http-scan |
| Class | other-software |
| 7D Avg | 35 |
| Vendor | Apache |
| 30D Avg | 44 |
| 90D Avg | 45 |
| Product | Log4j |
| Cisa Kev | yes |
| Connections | 1627 |
| Observation Date | 2026-07-04 |
| Vulnerability Class | CVSS |
| Vulnerability Score | 10 |
| Vulnerability Severity | Critical |
References
KEVIntel
Known Exploited Vulnerability - GCVE BCP-07 Compliant
Exploited: Yes
Timestamps
Scope
Evidence
Type: Public Report
Signal: Confirmed Compromise
Confidence: 70%
Source: kevintel
Details
| Feed | KEVIntel (kevintel.com) |
|---|---|
| Title | Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints |
| Vendor | Apache Software Foundation |
| Product | Apache Log4j2 |
| Added Date | 2021-12-10T00:00:00.000Z |
| Cvss Score | 10.0 |
| Epss Score | 0.99999 |
| Cvss Severity | CRITICAL |
| Epss Percentile | 1.0 |
| Used In Malware | yes |
| Ahead Of Cisa Kev | None |
| Not Yet In Cisa Kev | False |
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T04:17:24.696Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://logging.apache.org/log4j/2.x/security.html"
},
{
"name": "[oss-security] 20211210 CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/12/10/1"
},
{
"name": "[oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/12/10/2"
},
{
"name": "20211210 Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"
},
{
"name": "[oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/12/10/3"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20211210-0007/"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/alert-cve-2021-44228.html"
},
{
"name": "DSA-5020",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-5020"
},
{
"name": "[debian-lts-announce] 20211212 [SECURITY] [DLA 2842-1] apache-log4j2 security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html"
},
{
"name": "FEDORA-2021-f0f501d01f",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/"
},
{
"name": "Microsoft\u2019s Response to CVE-2021-44228 Apache Log4j 2",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/"
},
{
"name": "[oss-security] 20211213 Re: CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/12/13/2"
},
{
"name": "[oss-security] 20211213 CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/12/13/1"
},
{
"name": "[oss-security] 20211214 CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/12/14/4"
},
{
"name": "20211210 A Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"
},
{
"name": "VU#930724",
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://www.kb.cert.org/vuls/id/930724"
},
{
"tags": [
"x_transferred"
],
"url": "https://twitter.com/kurtseifried/status/1469345530182455296"
},
{
"tags": [
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html"
},
{
"name": "20211210 Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"
},
{
"name": "[oss-security] 20211215 Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/12/15/3"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf"
},
{
"name": "FEDORA-2021-66d6c484f3",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpujan2022.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html"
},
{
"name": "20220314 APPLE-SA-2022-03-14-7 Xcode 13.3",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2022/Mar/23"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/cisagov/log4j-affected-db"
},
{
"tags": [
"x_transferred"
],
"url": "https://support.apple.com/kb/HT213189"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html"
},
{
"name": "20220721 Open-Xchange Security Advisory 2022-07-21",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2022/Jul/11"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html"
},
{
"name": "20221208 Intel Data Center Manager \u003c= 5.1 Local Privileges Escalation",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2022/Dec/2"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2021-44228",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-04T14:25:34.416117Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2021-12-10",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:25:23.121Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228"
}
],
"timeline": [
{
"lang": "en",
"time": "2021-12-10T00:00:00.000Z",
"value": "CVE-2021-44228 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Apache Log4j2",
"vendor": "Apache Software Foundation",
"versions": [
{
"changes": [
{
"at": "2.3.1",
"status": "unaffected"
},
{
"at": "2.4",
"status": "affected"
},
{
"at": "2.12.2",
"status": "unaffected"
},
{
"at": "2.13.0",
"status": "affected"
},
{
"at": "2.15.0",
"status": "unaffected"
}
],
"lessThan": "log4j-core*",
"status": "affected",
"version": "2.0-beta9",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Chen Zhaojun of Alibaba Cloud Security Team."
}
],
"descriptions": [
{
"lang": "en",
"value": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects."
}
],
"metrics": [
{
"other": {
"content": {
"other": "critical"
},
"type": "unknown"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-03T00:00:00.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"url": "https://logging.apache.org/log4j/2.x/security.html"
},
{
"name": "[oss-security] 20211210 CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/12/10/1"
},
{
"name": "[oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/12/10/2"
},
{
"name": "20211210 Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021",
"tags": [
"vendor-advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"
},
{
"name": "[oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/12/10/3"
},
{
"url": "https://security.netapp.com/advisory/ntap-20211210-0007/"
},
{
"url": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"
},
{
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032"
},
{
"url": "https://www.oracle.com/security-alerts/alert-cve-2021-44228.html"
},
{
"name": "DSA-5020",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-5020"
},
{
"name": "[debian-lts-announce] 20211212 [SECURITY] [DLA 2842-1] apache-log4j2 security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html"
},
{
"name": "FEDORA-2021-f0f501d01f",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/"
},
{
"name": "Microsoft\u2019s Response to CVE-2021-44228 Apache Log4j 2",
"tags": [
"vendor-advisory"
],
"url": "https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/"
},
{
"name": "[oss-security] 20211213 Re: CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/12/13/2"
},
{
"name": "[oss-security] 20211213 CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/12/13/1"
},
{
"name": "[oss-security] 20211214 CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/12/14/4"
},
{
"name": "20211210 A Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021",
"tags": [
"vendor-advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"
},
{
"name": "VU#930724",
"tags": [
"third-party-advisory"
],
"url": "https://www.kb.cert.org/vuls/id/930724"
},
{
"url": "https://twitter.com/kurtseifried/status/1469345530182455296"
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf"
},
{
"url": "http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html"
},
{
"url": "http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"
},
{
"url": "http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html"
},
{
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html"
},
{
"name": "20211210 Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021",
"tags": [
"vendor-advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"
},
{
"name": "[oss-security] 20211215 Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/12/15/3"
},
{
"url": "http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html"
},
{
"url": "http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html"
},
{
"url": "http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html"
},
{
"url": "http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html"
},
{
"url": "http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf"
},
{
"name": "FEDORA-2021-66d6c484f3",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/"
},
{
"url": "http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf"
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2022.html"
},
{
"url": "http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html"
},
{
"url": "https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md"
},
{
"url": "http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html"
},
{
"url": "http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html"
},
{
"name": "20220314 APPLE-SA-2022-03-14-7 Xcode 13.3",
"tags": [
"mailing-list"
],
"url": "http://seclists.org/fulldisclosure/2022/Mar/23"
},
{
"url": "https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001"
},
{
"url": "https://github.com/cisagov/log4j-affected-db"
},
{
"url": "https://support.apple.com/kb/HT213189"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"url": "https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228"
},
{
"url": "https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html"
},
{
"name": "20220721 Open-Xchange Security Advisory 2022-07-21",
"tags": [
"mailing-list"
],
"url": "http://seclists.org/fulldisclosure/2022/Jul/11"
},
{
"url": "http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html"
},
{
"url": "http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html"
},
{
"name": "20221208 Intel Data Center Manager \u003c= 5.1 Local Privileges Escalation",
"tags": [
"mailing-list"
],
"url": "http://seclists.org/fulldisclosure/2022/Dec/2"
},
{
"url": "http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2021-44228",
"datePublished": "2021-12-10T00:00:00.000Z",
"dateReserved": "2021-11-26T00:00:00.000Z",
"dateUpdated": "2025-10-21T23:25:23.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"cisa_known_exploited": {
"cveID": "CVE-2021-44228",
"cwes": "[\"CWE-20\", \"CWE-400\", \"CWE-502\"]",
"dateAdded": "2021-12-10",
"dueDate": "2021-12-24",
"knownRansomwareCampaignUse": "Known",
"notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
"product": "Log4j2",
"requiredAction": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.",
"shortDescription": "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.",
"vendorProject": "Apache",
"vulnerabilityName": "Apache Log4j2 Remote Code Execution Vulnerability"
},
"epss": {
"cve": "CVE-2021-44228",
"date": "2026-07-06",
"epss": "0.99999",
"percentile": "1.0"
},
"fkie_nvd": {
"cisaActionDue": "2021-12-24",
"cisaExploitAdd": "2021-12-10",
"cisaRequiredAction": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.",
"cisaVulnerabilityName": "Apache Log4j2 Remote Code Execution Vulnerability",
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.0.1\", \"versionEndExcluding\": \"2.3.1\", \"matchCriteriaId\": \"03FA5E81-F9C0-403E-8A4B-E4284E4E7B72\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.4.0\", \"versionEndExcluding\": \"2.12.2\", \"matchCriteriaId\": \"AED3D5EC-DAD5-4E5F-8BBD-B4E3349D84FC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.13.0\", \"versionEndExcluding\": \"2.15.0\", \"matchCriteriaId\": \"D31D423D-FC4D-428A-B863-55AF472B80DC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"17854E42-7063-4A55-BF2A-4C7074CC2D60\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*\", \"matchCriteriaId\": \"53F32FB2-6970-4975-8BD0-EAE12E9AD03A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"B773ED91-1D39-42E6-9C52-D02210DE1A94\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"EF24312D-1A62-482E-8078-7EC24758B710\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E8320869-CBF4-4C92-885C-560C09855BFA\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:siemens:sppa-t3000_ses3000:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"755BA221-33DD-40A2-A517-8574D042C261\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:captial:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2019.1\", \"matchCriteriaId\": \"07856DAA-EDB4-4522-BA16-CD302C9E39EF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:captial:2019.1:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"F7AD819D-D093-472E-AA47-1A925111E4C8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:captial:2019.1:sp1912:*:*:*:*:*:*\", \"matchCriteriaId\": \"2D07A11A-A3C6-4D44-B2E0-A8358D23947A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"61597661-A3B0-4A14-AA6B-C911E0063390\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BB524B33-68E7-46A2-B5CE-BCD9C3194B8B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5F852C6D-44A0-4CCE-83C7-4501CAD73F9F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AA61161C-C2E7-4852-963E-E2D3DFBFDC7B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A76AA04A-BB43-4027-895E-D1EACFCDF41B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2A6B60F3-327B-49B7-B5E4-F1C60896C9BB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4BCF281E-B0A2-49E2-AEF8-8691BDCE08D5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:desigo_cc_info_center:5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A87EFCC4-4BC1-4FEA-BAA4-8FF221838EBD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:e-car_operation_center:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2021-12-13\", \"matchCriteriaId\": \"B678380B-E95E-4A8B-A49D-D13B62AA454E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:energy_engage:3.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4557476B-0157-44C2-BB50-299E7C7E1E72\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"991B2959-5AA3-4B68-A05A-42D9860FAA9D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:energyip:8.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7E5948A0-CA31-41DF-85B6-1E6D09E5720B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:energyip:8.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4C08D302-EEAC-45AA-9943-3A5F09E29FAB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:energyip:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D53BA68C-B653-4507-9A2F-177CF456960F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:energyip_prepay:3.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1F0C3D5E-579F-42C6-9D8C-37969A1D17D2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:energyip_prepay:3.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2C16C460-9482-4A22-92AC-1AE0E87D7F28\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"8.6.2j-398\", \"matchCriteriaId\": \"0E180527-5C36-4158-B017-5BEDC0412FD6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AFDADA98-1CD0-45DA-9082-BFC383F7DB97\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:industrial_edge_management:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E33D707F-100E-4DE7-A05B-42467DE75EAC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:industrial_edge_management_hub:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2021-12-13\", \"matchCriteriaId\": \"DD3EAC80-44BE-41D2-8D57-0EE3DBA1E1B1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:logo\\\\!_soft_comfort:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2AC8AB52-F4F4-440D-84F5-2776BFE1957A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6AF6D774-AC8C-49CA-A00B-A2740CA8FA91\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:mindsphere:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2021-12-11\", \"matchCriteriaId\": \"6423B1A7-F09F-421A-A0AC-3059CB89B110\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2021-12-13\", \"matchCriteriaId\": \"48C6A61B-2198-4B9E-8BCF-824643C81EC3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:nx:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BEE2F7A1-8281-48F1-8BFB-4FE0D7E1AEF4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"3.2\", \"matchCriteriaId\": \"C74B9880-FFF9-48CA-974F-54FB80F30D2D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1.1.3\", \"matchCriteriaId\": \"74D1F4AD-9A60-4432-864F-4505B3C60659\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7ABA5332-8D1E-4129-A557-FCECBAC12827\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:sentron_powermanager:4.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9C3AA865-5570-4C8B-99DE-431AD7B163F1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:siguard_dsa:4.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"00E03FB6-37F9-4559-8C86-F203D6782920\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:siguard_dsa:4.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"90439591-BA01-4007-A2B6-B316548D4595\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:siguard_dsa:4.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E1F3B8B4-4D1B-4913-BD5F-1A04B47F829A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"83E77D85-0AE8-41D6-AC0C-983A8B73C831\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"02B28A44-3708-480D-9D6D-DDF8C21A15EC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"4.16.2.1\", \"matchCriteriaId\": \"2FC0A575-F771-4B44-A0C6-6A5FD98E5134\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6D1D6B61-1F17-4008-9DFB-EF419777768E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9772EE3F-FFC5-4611-AD9A-8AD8304291BB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CF524892-278F-4373-A8A3-02A30FA1AFF4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:siveillance_vantage:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F30DE588-9479-46AA-8346-EA433EE83A5F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:siveillance_viewpoint:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4941EAD6-8759-4C72-ABA6-259C0E838216\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:solid_edge_cam_pro:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5BF2708F-0BD9-41BF-8CB1-4D06C4EFB777\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:solid_edge_harness_design:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2020\", \"matchCriteriaId\": \"0762031C-DFF1-4962-AE05-0778B27324B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:solid_edge_harness_design:2020:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"96271088-1D1B-4378-8ABF-11DAB3BB4DDC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:solid_edge_harness_design:2020:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"2595AD24-2DF2-4080-B780-BC03F810B9A9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:solid_edge_harness_design:2020:sp2002:*:*:*:*:*:*\", \"matchCriteriaId\": \"88096F08-F261-4E3E-9EEB-2AB0225CD6F3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.70\", \"matchCriteriaId\": \"044994F7-8127-4F03-AA1A-B2AB41D68AF5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:spectrum_power_4:4.70:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"A6CB3A8D-9577-41FB-8AC4-0DF8DE6A519C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:spectrum_power_4:4.70:sp7:*:*:*:*:*:*\", \"matchCriteriaId\": \"17B7C211-6339-4AF2-9564-94C7DE52EEB7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:spectrum_power_4:4.70:sp8:*:*:*:*:*:*\", \"matchCriteriaId\": \"DBCCBBBA-9A4F-4354-91EE-10A1460BBA3F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.30\", \"matchCriteriaId\": \"12F81F6B-E455-4367-ADA4-8A5EC7F4754A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:spectrum_power_7:2.30:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A5EF509E-3799-4718-B361-EFCBA17AEEF3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:spectrum_power_7:2.30:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"8CA31645-29FC-4432-9BFC-C98A808DB8CF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:spectrum_power_7:2.30:sp2:*:*:*:*:*:*\", \"matchCriteriaId\": \"BB424991-0B18-4FFC-965F-FCF4275F56C5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1B209EFE-77F2-48CD-A880-ABA0A0A81AB1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:vesys:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2019.1\", \"matchCriteriaId\": \"72D238AB-4A1F-458D-897E-2C93DCD7BA6C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:vesys:2019.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9778339A-EA93-4D18-9A03-4EB4CBD25459\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:vesys:2019.1:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"1747F127-AB45-4325-B9A1-F3D12E69FFC8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:vesys:2019.1:sp1912:*:*:*:*:*:*\", \"matchCriteriaId\": \"18BBEF7C-F686-4129-8EE9-0F285CE38845\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:xpedition_enterprise:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AD525494-2807-48EA-AED0-11B9CB5A6A9B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:xpedition_package_integrator:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1EDCBF98-A857-48BC-B04D-6F36A1975AA5\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:intel:audio_development_kit:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"099344DD-8AEE-49A0-88A8-691A8A1E651F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:intel:computer_vision_annotation_tool:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"12A06BF8-E4DC-4389-8A91-8AC7598E0009\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:intel:data_center_manager:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.1\", \"matchCriteriaId\": \"8555F365-2BFD-4A0A-A7D0-1459241758B3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:intel:genomics_kernel_library:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"18989EBC-E1FB-473B-83E0-48C8896C2E96\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:intel:oneapi_sample_browser:-:*:*:*:*:eclipse:*:*\", \"matchCriteriaId\": \"EDE66B6C-25E5-49AE-B35F-582130502222\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:intel:secure_device_onboard:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"22BEE177-D117-478C-8EAD-9606DEDF9FD5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:intel:sensor_solution_firmware_development_kit:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F021E2E7-0D8F-4336-82A6-77E521347C4F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:intel:system_debugger:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1F66B0A2-22C0-41D5-B866-1764DEC12CB2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:intel:system_studio:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FC619106-991C-413A-809D-C2410EBA4CDB\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DEECE5FC-CACF-4496-A3E7-164736409252\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A930E247-0B43-43CB-98FF-6CE7B8189835\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"80E516C0-98A4-4ADE-B69F-66A772E2BAAA\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"10.0.12\", \"matchCriteriaId\": \"B5BAA8A5-74B3-48EB-8287-302927197A4E\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*\", \"matchCriteriaId\": \"F3E0B672-3E06-4422-B2A4-0BD073AEC2A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*\", \"matchCriteriaId\": \"3A756737-1CC4-42C2-A4DF-E1C893B4E2D5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*\", \"matchCriteriaId\": \"B55E8D50-99B4-47EC-86F9-699B67D473CE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:cloud_insights:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"26FCA75B-4282-4E0F-95B4-640A82C8E91C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"197D0D80-6702-4B61-B681-AFDBA7D69067\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F1BE6C1F-2565-4E97-92AA-16563E5660A5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:ontap_tools:-:*:*:*:*:vmware_vsphere:*:*\", \"matchCriteriaId\": \"CBCC384C-5DF0-41AB-B17B-6E9B6CAE8065\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:vmware_vsphere:*:*\", \"matchCriteriaId\": \"F3A48D58-4291-4D3C-9CEA-BF12183468A7\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:advanced_malware_protection_virtual_private_cloud_appliance:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.5.4\", \"matchCriteriaId\": \"4E52AF19-0158-451B-8E36-02CB6406083F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:automated_subsea_tuning:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.1.0\", \"matchCriteriaId\": \"CB21CFB4-4492-4C5D-BD07-FFBE8B5D92B6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:broadworks:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2021.11_1.162\", \"matchCriteriaId\": \"97426511-9B48-46F5-AC5C-F9781F1BAE2F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:business_process_automation:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.0.000.115\", \"matchCriteriaId\": \"82306B9F-AE97-4E29-A8F7-2E5BA52998A7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:business_process_automation:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.1.000.000\", \"versionEndExcluding\": \"3.1.000.044\", \"matchCriteriaId\": \"4C903C85-DC0F-47D8-B8BE-7A666877B017\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:business_process_automation:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.2.000.000\", \"versionEndExcluding\": \"3.2.000.009\", \"matchCriteriaId\": \"E4C6F9E0-5DCE-431D-AE7E-B680AC1F9332\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:cloud_connect:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"12.6\\\\(1\\\\)\", \"matchCriteriaId\": \"52CF6199-8028-4076-952B-855984F30129\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:cloudcenter:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.10.0.16\", \"matchCriteriaId\": \"622BB8D9-AC81-4C0F-A5C5-C5E51F0BC0D1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:cloudcenter_cost_optimizer:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.5.2\", \"matchCriteriaId\": \"38FB3CE1-5F62-4798-A825-4E3DB07E868F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:cloudcenter_suite_admin:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.3.1\", \"matchCriteriaId\": \"29CDB878-B085-448E-AB84-25B1E2D024F8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:cloudcenter_workload_manager:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.5.2\", \"matchCriteriaId\": \"C25FDA96-9490-431F-B8B6-CC2CC272670E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:common_services_platform_collector:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.9.1.3\", \"matchCriteriaId\": \"51CD9E4C-9385-435C-AD18-6C36C8DF7B65\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:common_services_platform_collector:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.10.0\", \"versionEndExcluding\": \"2.10.0.1\", \"matchCriteriaId\": \"FC0AC4C1-CB06-4084-BFBB-5B702C384C53\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:connected_mobile_experiences:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3871EBD2-F270-435A-B98C-A282E1C52693\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:contact_center_domain_manager:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"12.5\\\\(1\\\\)\", \"matchCriteriaId\": \"8D4DF34B-E8C2-41C8-90E2-D119B50E4E7E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:contact_center_management_portal:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"12.5\\\\(1\\\\)\", \"matchCriteriaId\": \"C8EF64DA-73E4-4E5E-8F9A-B837C947722E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:crosswork_data_gateway:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.0.2\", \"matchCriteriaId\": \"66E1E4FC-0B6E-4CFA-B003-91912F8785B2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:crosswork_data_gateway:3.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1B2390C3-C319-4F05-8CF0-0D30F9931507\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:crosswork_network_controller:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.0.1\", \"matchCriteriaId\": \"C154491E-06C7-48B0-AC1D-89BBDBDB902E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:crosswork_network_controller:3.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1E98EC48-0CED-4E02-9CCB-06EF751F2BDC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:crosswork_optimization_engine:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.0.1\", \"matchCriteriaId\": \"C569DC2A-CFF6-4E13-A50C-E215A4F96D99\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:crosswork_optimization_engine:3.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"258A51AC-6649-4F67-A842-48A7AE4DCEE1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:crosswork_platform_infrastructure:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.0.1\", \"matchCriteriaId\": \"8DC22505-DE11-4A1B-8C06-1E306419B031\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:crosswork_platform_infrastructure:4.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9E31AC54-B928-48B5-8293-F5F4A7A8C293\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:crosswork_zero_touch_provisioning:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.0.1\", \"matchCriteriaId\": \"5B8AE870-6FD0-40D2-958B-548E2D7A7B75\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:crosswork_zero_touch_provisioning:3.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"68E7D83B-B6AC-45B1-89A4-D18D7A6018DD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:customer_experience_cloud_agent:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.12.1\", \"matchCriteriaId\": \"17660B09-47AA-42A2-B5FF-8EBD8091C661\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:cyber_vision_sensor_management_extension:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.0.3\", \"matchCriteriaId\": \"FBEF9A82-16AE-437A-B8CF-CC7E9B6C4E44\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:data_center_network_manager:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"11.3\\\\(1\\\\)\", \"matchCriteriaId\": \"843147AE-8117-4FE9-AE74-4E1646D55642\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:data_center_network_manager:11.3\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7EB871C9-CA14-4829-AED3-CC2B35E99E92\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:dna_center:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.1.2.8\", \"matchCriteriaId\": \"4FF8A83D-A282-4661-B133-213A8838FB27\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:dna_center:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.2.2.0\", \"versionEndExcluding\": \"2.2.2.8\", \"matchCriteriaId\": \"139CDAA5-63E9-4E56-AF72-745BD88E4B49\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:dna_center:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.2.3.0\", \"versionEndExcluding\": \"2.2.3.4\", \"matchCriteriaId\": \"01FD99C4-BCB1-417E-ADCE-73314AD2E857\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:dna_spaces\\\\:_connector:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.5\", \"matchCriteriaId\": \"9031BE8A-646A-4581-BDE5-750FB0CE04CB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:emergency_responder:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"11.5\\\\(4\\\\)\", \"matchCriteriaId\": \"15BED3E2-46FF-4E58-8C5D-4D8FE5B0E527\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:enterprise_chat_and_email:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"12.0\\\\(1\\\\)\", \"matchCriteriaId\": \"7C950436-2372-4C4B-9B56-9CB48D843045\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"4.1.1\", \"matchCriteriaId\": \"0B61F186-D943-4711-B3E0-875BB570B142\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"12.6\\\\(1\\\\)\", \"matchCriteriaId\": \"2A285C40-170D-4C95-8031-2C6E4D5FB1D4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.6\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C0F02B5-AA2A-48B2-AE43-38B45532C563\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:fog_director:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"830BDB28-963F-46C3-8D50-638FDABE7F64\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.4.0\", \"matchCriteriaId\": \"54553C65-6BFA-40B1-958D-A4E3289D6B1D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:identity_services_engine:2.4.0:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"439948AD-C95D-4FC3-ADD1-C3D241529F12\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.3.2.1\", \"matchCriteriaId\": \"9C2002AE-0F3C-4A06-9B9A-F77A9F700EB2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:intersight_virtual_appliance:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.0.9-361\", \"matchCriteriaId\": \"596A986D-E7DC-4FC4-A776-6FE87A91D7E4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:iot_operations_dashboard:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DD93434E-8E75-469C-B12B-7E2B6EDCAA79\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_assurance_engine:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.0.2\", \"matchCriteriaId\": \"78684844-4974-41AD-BBC1-961F60025CD2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.3.5.1\", \"matchCriteriaId\": \"3A00D235-FC9C-4EB7-A16C-BB0B09802E61\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.4\", \"versionEndExcluding\": \"5.4.5.2\", \"matchCriteriaId\": \"C60FDD1B-898E-4FCB-BDE2-45A7CBDBAF4F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.5.4.1\", \"matchCriteriaId\": \"E7A33E5F-BBC7-4917-9C63-900248B546D9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.6\", \"versionEndExcluding\": \"5.6.3.1\", \"matchCriteriaId\": \"12D98A7C-4992-4E58-A6BD-3D8173C8F2B0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:nexus_dashboard:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.1.2\", \"matchCriteriaId\": \"E2DDC1AF-31B5-4F05-B84F-8FD23BE163DA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:nexus_insights:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.0.2\", \"matchCriteriaId\": \"A4540CF6-D33E-4D33-8608-11129D6591FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:optical_network_controller:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.1.0\", \"matchCriteriaId\": \"129A7615-99E7-41F8-8EBC-CEDA10AD89AD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:packaged_contact_center_enterprise:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"11.6\", \"matchCriteriaId\": \"5F46A7AC-C133-442D-984B-BA278951D0BF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:packaged_contact_center_enterprise:11.6\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A1A75AB6-C3A7-4299-B35A-46A4BCD00816\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:paging_server:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.4.1\", \"matchCriteriaId\": \"0A73E888-C8C2-4AFD-BA60-566D45214BCA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_service_catalog:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"12.1\", \"matchCriteriaId\": \"4B0D0FD0-ABC6-465F-AB8D-FA8788B1B2DD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"20.3.4.1\", \"matchCriteriaId\": \"D673F6F7-C42A-4538-96F0-34CB4F0CB080\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"20.4\", \"versionEndExcluding\": \"20.4.2.1\", \"matchCriteriaId\": \"FD374819-3CED-4260-90B6-E3C1333EAAD2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"20.5\", \"versionEndExcluding\": \"20.5.1.1\", \"matchCriteriaId\": \"D2D89973-94AF-4BE7-8245-275F3FEB30F4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"20.6\", \"versionEndExcluding\": \"20.6.2.1\", \"matchCriteriaId\": \"91A9A889-2C2B-4147-8108-C35291761C15\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:smart_phy:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.2.1\", \"matchCriteriaId\": \"D0EEA1EC-C63C-4C7D-BFAE-BA4556332242\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:ucs_central:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.0\\\\(1p\\\\)\", \"matchCriteriaId\": \"ACE22D97-42FA-4179-99E5-C2EE582DB7FF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.8.2.0\", \"matchCriteriaId\": \"F6B5DB6D-9E7D-4403-8028-D7DA7493716B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*\", \"versionEndExcluding\": \"11.5\\\\(1\\\\)\", \"matchCriteriaId\": \"B98D7AD5-0590-43FB-8AC0-376C9C500C15\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*\", \"versionEndExcluding\": \"11.5\\\\(1\\\\)\", \"matchCriteriaId\": \"D9DA1900-9972-4DFD-BE2E-74DABA1ED9A9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"42A41C41-A370-4C0E-A49D-AD42B2F3FB5C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1\\\\):*:*:*:-:*:*:*\", \"matchCriteriaId\": \"7E958AFF-185D-4D55-B74B-485BEAEC42FD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1\\\\):*:*:*:session_management:*:*:*\", \"matchCriteriaId\": \"F770709C-FFB2-4A4E-A2D8-2EAA23F2E87C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1\\\\)su3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B85B81F9-8837-426E-8639-AB0712CD1A96\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"11.5\\\\(1\\\\)\", \"matchCriteriaId\": \"C1CCCD27-A247-4720-A2FE-C8ED55D1D0DE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"34D89C42-AAD9-4B04-9F95-F77681E39553\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_contact_center_enterprise:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"11.6\\\\(2\\\\)\", \"matchCriteriaId\": \"897C8893-B0B6-4D6E-8D70-31B421D80B9A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_contact_center_enterprise:11.6\\\\(2\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"91D62A73-21B5-4D16-A07A-69AED2D40CC0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_contact_center_express:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"12.5\\\\(1\\\\)\", \"matchCriteriaId\": \"B0492049-D3AC-4512-A4BF-C9C26DA72CB0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_customer_voice_portal:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"11.6\", \"matchCriteriaId\": \"3868A8AA-6660-4332-AB0C-089C150D00E7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_customer_voice_portal:11.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"58BD72D6-4A79-49C9-9652-AB0136A591FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_customer_voice_portal:12.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A32761FD-B435-4E51-807C-2B245857F90E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_customer_voice_portal:12.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"154F7F71-53C5-441C-8F5C-0A82CB0DEC43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"11.5\\\\(1\\\\)\", \"matchCriteriaId\": \"65FD3873-2663-4C49-878F-7C65D4B8E455\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:video_surveillance_operations_manager:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"7.14.4\", \"matchCriteriaId\": \"0886FB04-24AA-4995-BA53-1E44F94E114E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:virtual_topology_system:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.6.7\", \"matchCriteriaId\": \"C61805C1-1F73-462C-A9CA-BB0CA4E57D0B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:virtualized_infrastructure_manager:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.2.0\", \"matchCriteriaId\": \"5EB39834-0F6D-4BD7-AFEC-DD8BEE46DA50\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:virtualized_infrastructure_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.4.0\", \"versionEndExcluding\": \"3.4.4\", \"matchCriteriaId\": \"0B78DD21-15F2-47A4-8A99-6DB6756920AC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:virtualized_voice_browser:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"12.5\\\\(1\\\\)\", \"matchCriteriaId\": \"7C6222EB-36E1-4CD5-BD69-5A921ED5DA6A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:wan_automation_engine:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"7.3.0.2\", \"matchCriteriaId\": \"C200CABD-F91B-49C4-A262-C56370E44B4C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.0\", \"matchCriteriaId\": \"DE22BE9B-374E-43DC-BA91-E3B9699A4C7C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:3.0:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"61D1081F-87E8-4E8B-BEBD-0F239E745586\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8D138973-02B0-4FEC-A646-FF1278DA1EDF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release2:*:*:*:*:*:*\", \"matchCriteriaId\": \"30B55A5B-8C5E-4ECB-9C85-A8A3A3030850\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3:*:*:*:*:*:*\", \"matchCriteriaId\": \"14DBEC10-0641-441C-BE15-8F72C1762DCE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3:-:*:*:*:*:*\", \"matchCriteriaId\": \"205C1ABA-2A4F-480F-9768-7E3EC43B03F5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_security_patch4:*:*:*:*:*:*\", \"matchCriteriaId\": \"D36FE453-C43F-448B-8A59-668DE95468C0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_security_patch5:*:*:*:*:*:*\", \"matchCriteriaId\": \"E8DF0944-365F-4149-9059-BDFD6B131DC5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_service_pack_2:*:*:*:*:*:*\", \"matchCriteriaId\": \"6B37AA08-13C7-4FD0-8402-E344A270C8F7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_service_pack_3:*:*:*:*:*:*\", \"matchCriteriaId\": \"2AA56735-5A5E-4D8C-B09D-DBDAC2B5C8E9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release4:*:*:*:*:*:*\", \"matchCriteriaId\": \"4646849B-8190-4798-833C-F367E28C1881\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:4.0:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"4D6CF856-093A-4E89-A71D-50A2887C265B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release1:*:*:*:*:*:*\", \"matchCriteriaId\": \"B36A9043-0621-43CD-BFCD-66529F937859\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release2:*:*:*:*:*:*\", \"matchCriteriaId\": \"8842B42E-C412-4356-9F54-DFC53B683D3E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release3:*:*:*:*:*:*\", \"matchCriteriaId\": \"D25BC647-C569-46E5-AD45-7E315EBEB784\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:workload_optimization_manager:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.2.1\", \"matchCriteriaId\": \"B468EDA1-CDEF-44D4-9D62-C433CF27F631\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:unified_intelligence_center:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"12.6\\\\(1\\\\)\", \"matchCriteriaId\": \"C90C6CD1-4678-4621-866B-F0CE819C8000\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:unified_sip_proxy:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"10.2.1v2\", \"matchCriteriaId\": \"9E4905E2-2129-469C-8BBD-EDA258815E2B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:unified_workforce_optimization:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"11.5\\\\(1\\\\)\", \"matchCriteriaId\": \"EC86AC6C-7C08-4EB9-A588-A034113E4BB1\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_1010:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7FFE3880-4B85-4E23-9836-70875D5109F7\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_1120:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"727A02E8-40A1-4DFE-A3A2-91D628D3044F\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_1140:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"19F6546E-28F4-40DC-97D6-E0E023FE939B\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_1150:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EB3B0EC3-4654-4D90-9D41-7EC2AD1DDF99\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_2110:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"52D96810-5F79-4A83-B8CA-D015790FCF72\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_2120:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"16FE2945-4975-4003-AE48-7E134E167A7F\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_2130:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DCE7122A-5AA7-4ECD-B024-E27C9D0CFB7B\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_2140:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"976901BF-C52C-4F81-956A-711AF8A60140\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_4110:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A0CBC7F5-7767-43B6-9384-BE143FCDBD7F\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_4112:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"957D64EB-D60E-4775-B9A8-B21CA48ED3B1\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_4115:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A694AD51-9008-4AE6-8240-98B17AB527EE\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_4120:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"38AE6DC0-2B03-4D36-9856-42530312CC46\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_4125:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"71DCEF22-ED20-4330-8502-EC2DD4C9838F\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_4140:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3DB2822B-B752-4CD9-A178-934957E306B4\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_4145:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"81F4868A-6D62-479C-9C19-F9AABDBB6B24\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_4150:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"65378F3A-777C-4AE2-87FB-1E7402F9EA1B\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07DAFDDA-718B-4B69-A524-B0CEB80FE960\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:fxos:6.2.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"82C8AD48-0130-4C20-ADEC-697668E2293B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:fxos:6.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4E75EF7C-8D71-4D70-91F0-74FC99A90CC3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:fxos:6.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2DB7EE7D-8CB4-4804-9F9D-F235608E86E1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:fxos:6.5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"77571973-2A94-4E15-AC5B-155679C3C565\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:fxos:6.6.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CA405A50-3F31-48ED-9AF1-4B02F5B367DE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:fxos:6.7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D3753953-04E8-4382-A6EC-CD334DD83CF4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:fxos:7.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B4A5F89F-1296-4A0F-A36D-082A481F190F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:fxos:7.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F50F48AF-44FF-425C-9685-E386F956C901\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:automated_subsea_tuning:02.01.00:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A4D28E76-56D4-4C9A-A660-7CD7E0A1AC9F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:broadworks:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CD975A0E-00A6-475E-9064-1D64E4291499\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:cloudcenter_suite:4.10\\\\(0.15\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2E50AC21-DA54-4BC8-A503-1935FD1714C7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:cloudcenter_suite:5.3\\\\(0\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4D05E169-4AF1-4127-A917-056EC2CE781B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:cloudcenter_suite:5.4\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8AD415A2-422E-4F15-A177-C3696FEAFF0C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:cloudcenter_suite:5.5\\\\(0\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"134443B7-7BA8-4B50-8874-D4BF931BECFD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:cloudcenter_suite:5.5\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"73ADF6EA-CD29-4835-8D72-84241D513AFF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:common_services_platform_collector:002.009\\\\(000.000\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BAC1A386-04C7-45B2-A883-1CD9AB60C14B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:common_services_platform_collector:002.009\\\\(000.001\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3F0F1639-D69E-473A-8926-827CCF73ACC9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:common_services_platform_collector:002.009\\\\(000.002\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F4FDF900-E9D6-454A-BF6B-821620CA59F4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:common_services_platform_collector:002.009\\\\(001.000\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1859BD43-BA2B-45A5-B523-C6BFD34C7B01\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:common_services_platform_collector:002.009\\\\(001.001\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1EBC145C-9A2F-4B76-953E-0F690314511C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:common_services_platform_collector:002.009\\\\(001.002\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"158B7A53-FEC1-4B42-A1E2-E83E99564B07\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:common_services_platform_collector:002.010\\\\(000.000\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3A378971-1A08-4914-B012-8E24DCDEFC68\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:connected_analytics_for_network_deployment:006.004.000.003:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4E5CC012-DC85-481A-B82A-9323C19674DA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:connected_analytics_for_network_deployment:006.005.000.:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"76CF59ED-685D-46CD-80A2-AEDA4F03FE53\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:connected_analytics_for_network_deployment:006.005.000.000:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"960B07C0-E205-47E7-B578-46A0AF559D04\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.000.001:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A1A194E1-405E-47FA-8CDF-58EB78883ACC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.001.000:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2E628231-61FB-40AF-A20B-00F5CB78E63B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.002.000:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2EA25E92-2C76-4722-BA06-53F33C0D961C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:connected_analytics_for_network_deployment:7.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"51D2940A-0D03-415B-B72E-1F6862DDAC41\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.003.000:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B346ADC-00BE-4409-B658-A11351D2A7D4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.003.001.001:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5A0E44A9-C427-493B-868A-8A8DA405E759\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.003.003:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B2B31E7C-0EB3-4996-8859-DF94A3EE20B3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:connected_analytics_for_network_deployment:008.000.000:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3EAB3E03-275F-4942-9396-FC7A22F42C8D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:connected_analytics_for_network_deployment:008.000.000.000.004:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"19DAD751-D170-4914-BAB2-6054DFEEF404\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:crosswork_network_automation:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2F429F37-3576-4D8A-9901-359D65EC3CF4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:crosswork_network_automation:2.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F526DEF1-4A3E-4FE1-8153-E9252DAE5B92\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:crosswork_network_automation:3.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C19679D0-F4DC-4130-AFFD-692E5130531A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:crosswork_network_automation:4.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"60D2FBF3-D8AB-41F0-B170-9E56FBF7E2F7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:crosswork_network_automation:4.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F60324DD-8450-4B14-A7A1-0D5EA5163580\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:cx_cloud_agent:001.012:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"12F6DFD1-273B-4292-A22C-F2BE0DD3FB3F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:cyber_vision:4.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"13EA024C-97A4-4D33-BC3E-51DB77C51E76\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:cyber_vision_sensor_management_extension:4.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"85289E35-C7C2-46D0-9BDC-10648DD2C86F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:dna_center:2.2.2.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"17282822-C082-4FBC-B46D-468DCF8EF6B8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:dna_spaces:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F5463DA6-5D44-4C32-B46C-E8A2ADD7646B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:dna_spaces_connector:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"54A237CF-A439-4114-AF81-D75582F29573\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:emergency_responder:11.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A37D19BF-E4F5-4AF4-8942-0C3B62C4BF2B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:emergency_responder:11.5\\\\(4.65000.14\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EF25688B-6659-4C7C-866D-79AA1166AD7A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:emergency_responder:11.5\\\\(4.66000.14\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"47B70741-90D9-4676-BF16-8A21E147F532\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:enterprise_chat_and_email:12.0\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ED862A1B-E558-4D44-839C-270488E735BB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:enterprise_chat_and_email:12.5\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2678AF98-1194-4810-9933-5BA50E409F88\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:enterprise_chat_and_email:12.6\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"37E7DEBD-9E47-4D08-86BC-D1B013450A98\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:evolved_programmable_network_manager:3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1A935862-18F7-45FE-B647-1A9BA454E304\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:evolved_programmable_network_manager:3.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"69594997-2568-4C10-A411-69A50BFD175F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:evolved_programmable_network_manager:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1EC39E2D-C47B-4311-BC7B-130D432549F4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:evolved_programmable_network_manager:4.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EE5E6CBE-D82C-4001-87CB-73DF526F0AB1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:evolved_programmable_network_manager:5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"460E6456-0E51-45BC-868E-DEEA5E3CD366\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:evolved_programmable_network_manager:5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F7F58659-A318-42A0-83C5-8F09FCD78982\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.5\\\\(1\\\\):su1:*:*:*:*:*:*\", \"matchCriteriaId\": \"D8A49E46-8501-4697-A17A-249A7D9F5A0B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.5\\\\(1\\\\):su2:*:*:*:*:*:*\", \"matchCriteriaId\": \"5D81E7A9-0C2B-4603-91F0-ABF2380DBBA3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.6\\\\(1\\\\):-:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DFCE723-9359-40C7-BA35-B71BDF8E3CF3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.6\\\\(1\\\\):es01:*:*:*:*:*:*\", \"matchCriteriaId\": \"28B1524E-FDCA-4570-86DD-CE396271B232\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.6\\\\(1\\\\):es02:*:*:*:*:*:*\", \"matchCriteriaId\": \"74DC6F28-BFEF-4D89-93D5-10072DAC39C8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.6\\\\(1\\\\):es03:*:*:*:*:*:*\", \"matchCriteriaId\": \"BA1D60D7-1B4A-4EEE-A26C-389D9271E005\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:firepower_threat_defense:6.2.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1D726F07-06F1-4B0A-B010-E607E0C2A280\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:firepower_threat_defense:6.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3ED58B0E-FCC7-48E3-A5C0-6CC54A38BAE3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:firepower_threat_defense:6.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B2DF0B07-8C2A-4341-8AFF-DE7E5E5B3A43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:firepower_threat_defense:6.5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"41E168ED-D664-4749-805E-77644407EAFE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:firepower_threat_defense:6.6.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DCD69468-8067-4A5D-B2B0-EC510D889AA0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:firepower_threat_defense:6.7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"85F22403-B4EE-4303-9C94-915D3E0AC944\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:firepower_threat_defense:7.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BBCA75A6-0A3E-4393-8884-9F3CE190641E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:firepower_threat_defense:7.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D619BF54-1BA9-45D0-A876-92D7010088A0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:identity_services_engine:002.004\\\\(000.914\\\\):-:*:*:*:*:*:*\", \"matchCriteriaId\": \"808F8065-BD3A-4802-83F9-CE132EDB8D34\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:identity_services_engine:002.006\\\\(000.156\\\\):-:*:*:*:*:*:*\", \"matchCriteriaId\": \"B236B13E-93B9-424E-926C-95D3DBC6CA5D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:identity_services_engine:002.007\\\\(000.356\\\\):-:*:*:*:*:*:*\", \"matchCriteriaId\": \"8A63CC83-0A6E-4F33-A1BE-214A33B51518\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:identity_services_engine:003.000\\\\(000.458\\\\):-:*:*:*:*:*:*\", \"matchCriteriaId\": \"37DB7759-6529-46DE-B384-10F060D86A97\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:identity_services_engine:003.001\\\\(000.518\\\\):-:*:*:*:*:*:*\", \"matchCriteriaId\": \"8C640AD9-146E-488A-B166-A6BB940F97D3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:identity_services_engine:003.002\\\\(000.116\\\\):-:*:*:*:*:*:*\", \"matchCriteriaId\": \"DAC1FA7E-CB1B-46E5-A248-ABACECFBD6E8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:integrated_management_controller_supervisor:002.003\\\\(002.000\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7C3BD5AF-9FC1-494B-A676-CC3D4B8EAC8D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:integrated_management_controller_supervisor:2.3.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F477CACA-2AA0-417C-830D-F2D3AE93153A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:intersight_virtual_appliance:1.0.9-343:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7E3BE5E1-A6B6-46C7-B93B-8A9F5AEA2731\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:mobility_services_engine:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"04E0BB7B-0716-4DBD-89B9-BA11AAD77C00\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_assurance_engine:6.0\\\\(2.1912\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"64C98A76-0C31-45E7-882B-35AE0D2C5430\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.0\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"379F8D86-BE87-4250-9E85-494D331A0398\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.1\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"71F69E51-E59D-4AE3-B242-D6D2CFDB3F46\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.2\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"578DA613-8E15-4748-A4B7-646415449609\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.3\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"544EFAD6-CE2F-4E1D-9A00-043454B72889\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.4\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2E16DF9C-3B64-4220-82B6-6E20C7807BAA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.5\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B9CD5B8A-9846-48F1-9495-77081E44CBFC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.5\\\\(2\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"68E6CD49-6F71-4E17-B046-FBE91CE91CB7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.5\\\\(3\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0BDD8018-7E77-4C89-917E-ACDC678A7DE2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_insights_for_data_center:6.0\\\\(2.1914\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A7D39156-A47D-405E-8C02-CAE7D637F99A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:network_services_orchestrator:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5426FC59-411D-4963-AFEF-5B55F68B8958\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:optical_network_controller:1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"810E9A92-4302-4396-94D3-3003947DB2A7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:paging_server:8.3\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"522C36A5-7520-4368-BD92-9AB577756493\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:paging_server:8.4\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CB2EC4BE-FFAF-4605-8A96-2FEF35975540\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:paging_server:8.5\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CA1D3C2A-E5FA-400C-AC01-27A3E5160477\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:paging_server:9.0\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"63B27050-997B-4D54-8E5A-CE9E33904318\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:paging_server:9.0\\\\(2\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5ABF05B8-1B8A-4CCF-A1AD-D8602A247718\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:paging_server:9.1\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2F74580D-0011-4ED9-9A00-B4CDB6685154\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:paging_server:12.5\\\\(2\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"17A3C22E-1980-49B6-8985-9FA76A77A836\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:paging_server:14.0\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B1AB42DC-CE58-448A-A6B5-56F31B15F4A0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_service_catalog:12.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9DC32B55-0C76-4669-8EAD-DCC16355E887\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:sd-wan_vmanage:20.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6CDA737F-337E-4C30-B68D-EF908A8D6840\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:sd-wan_vmanage:20.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9DC5A89C-CCCF-49EC-B4FC-AB98ACB79233\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:sd-wan_vmanage:20.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4BA4F513-CBA1-4523-978B-D498CEDAE0CF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:sd-wan_vmanage:20.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6C53C6FD-B98E-4F7E-BA4D-391C90CF9E83\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:sd-wan_vmanage:20.6.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D00F6719-2C73-4D8D-8505-B9922E8A4627\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:sd-wan_vmanage:20.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EFE9210F-39C5-4828-9608-6905C1D378D4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:sd-wan_vmanage:20.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A1CEDCE4-CFD1-434B-B157-D63329CBA24A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:smart_phy:3.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"33660EB8-2984-4258-B8AD-141B7065C85E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:smart_phy:3.1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0ACA346D-5103-47F0-8BD9-7A8AD9B92E98\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:smart_phy:3.1.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A38BDF03-23C8-4BB6-A44D-68818962E7CB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:smart_phy:3.1.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3104C099-FEDA-466B-93CC-D55F058F7CD3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:smart_phy:3.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"890EA1C7-5990-4C71-857F-197E6F5B4089\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:smart_phy:21.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"56F21CF4-83FE-4529-9871-0FDD70D3095E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:ucs_central_software:2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B9331834-9EAD-46A1-9BD4-F4027E49D0C3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1a\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0E707E44-12CD-46C3-9124-639D0265432E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1b\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2FEE8482-DB64-4421-B646-9E5F560D1712\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1c\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4385CE6E-6283-4621-BBD9-8E66E2A34843\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1d\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9A6CDBD4-889B-442D-B272-C8E9A1B6AEC0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1e\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FF1E59F9-CF4F-4EFB-872C-5F503A04CCF4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1f\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1782219F-0C3D-45B7-80C7-D1DAA70D90B1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1g\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DDAB3BAD-1EC6-4101-A58D-42DA48D04D0C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1h\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8F7AA674-6BC2-490F-8D8A-F575B11F4BE0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1k\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6945C4DE-C070-453E-B641-2F5B9CFA3B6D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1l\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DAB8C7C0-D09B-4232-A88E-57D25AF45457\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1.17900.52\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ACEDB7B4-EBD4-4A37-9EE3-07EE3B46BE44\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1.18119.2\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"820D579C-AA45-4DC1-945A-748FFCD51CA2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1.18900.97\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7B23A9A6-CD04-4D76-BE3F-AFAFBB525F5E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1.21900.40\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A44E6007-7A3A-4AD3-9A65-246C59B73FB6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1.22900.28\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3D508E51-4075-4E34-BB7C-65AF9D56B49F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_communications_manager_im_\\\\\u0026_presence_service:11.5\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"376D06D5-D68E-4FF0-97E5-CBA2165A05CF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_communications_manager_im_\\\\\u0026_presence_service:11.5\\\\(1.22900.6\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"18ED6B8F-2064-4BBA-A78D-4408F13C724D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_computing_system:006.008\\\\(001.000\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"94091FE3-AB88-4CF5-8C4C-77B349E716A9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_contact_center_enterprise:11.6\\\\(2\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"91D62A73-21B5-4D16-A07A-69AED2D40CC0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_contact_center_enterprise:12.0\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"53F1314A-9A2C-43DC-8203-E4654EF013CC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_contact_center_enterprise:12.5\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0ADE468B-8F0C-490D-BB4C-358D947BA8E4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_contact_center_enterprise:12.6\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"32FEE78D-309E-491D-9AB6-98005F1CBF49\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_contact_center_enterprise:12.6\\\\(2\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"878D9901-675D-4444-B094-0BA505E7433F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_contact_center_express:12.5\\\\(1\\\\):-:*:*:*:*:*:*\", \"matchCriteriaId\": \"66E25EE4-AB7B-42BF-A703-0C2E83E83577\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_contact_center_express:12.5\\\\(1\\\\):su1:*:*:*:*:*:*\", \"matchCriteriaId\": \"D8F35520-F04A-4863-A1BC-0EDD2D1804F7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_contact_center_express:12.6\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EF9855FD-7747-4D9E-9542-703B1EC9A382\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_contact_center_express:12.6\\\\(2\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E07AF386-D8A5-44F5-A418-940C9F88A36A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_contact_center_management_portal:12.6\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"113C77DA-AC22-4D67-9812-8510EFC0A95F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_customer_voice_portal:11.6\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4BE221AB-A3B0-4CFF-9BC0-777773C2EF63\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_customer_voice_portal:12.0\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"15941265-1E7E-4C3E-AF1D-027C5E0D3141\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_customer_voice_portal:12.5\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"54AA2B0C-92A1-4B53-88D7-6E31120F5041\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_customer_voice_portal:12.6\\\\(1\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F9BD7207-85FB-4484-8720-4D11F296AC10\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_intelligence_center:12.6\\\\(1\\\\):-:*:*:*:*:*:*\", \"matchCriteriaId\": \"62E009C4-BE3E-4A14-91EF-8F667B2220A7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_intelligence_center:12.6\\\\(1\\\\):es01:*:*:*:*:*:*\", \"matchCriteriaId\": \"088512E1-434D-4685-992E-192A98ECAD9A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_intelligence_center:12.6\\\\(1\\\\):es02:*:*:*:*:*:*\", \"matchCriteriaId\": \"50A7BBC6-077C-4182-AA7A-577C4AAC3CD8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_intelligence_center:12.6\\\\(2\\\\):-:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0536F45-3A49-4F93-942E-AF679DFC7017\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_sip_proxy:010.000\\\\(000\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3D54794B-6CD5-46D7-B9E9-62A642143562\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_sip_proxy:010.000\\\\(001\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BE844DCA-FF52-43F5-BDD9-836A812A8CFF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_sip_proxy:010.002\\\\(000\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07B261EB-CA63-4796-BD15-A6770FD68B34\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_sip_proxy:010.002\\\\(001\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"29F9067A-B86C-4A6B-ACB7-DB125E04B795\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unified_workforce_optimization:11.5\\\\(1\\\\):sr7:*:*:*:*:*:*\", \"matchCriteriaId\": \"FAC4CC92-8BA0-4D96-9C48-5E311CDED53F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unity_connection:11.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8F2437A5-217A-4CD1-9B72-A31BDDC81F42\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:unity_connection:11.5\\\\(1.10000.6\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9C3CFF0D-BD70-4353-AE2F-6C55F8DE56A2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:video_surveillance_manager:7.14\\\\(1.26\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2CE47760-0E71-4FCA-97D1-CF0BB71CAC17\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:video_surveillance_manager:7.14\\\\(2.26\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"89B2D4F5-CB86-4B25-8C14-CED59E8A3F22\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:video_surveillance_manager:7.14\\\\(3.025\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B150B636-6267-4504-940F-DC37ABEFB082\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:video_surveillance_manager:7.14\\\\(4.018\\\\):*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D00B9911-A7CA-467E-B7A3-3AF31828D5D9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:virtual_topology_system:2.6.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B67C08C3-412F-4B7F-B98C-EEAEE77CBE4B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:wan_automation_engine:7.1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6D428C9B-53E1-4D26-BB4D-57FDE02FA613\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:wan_automation_engine:7.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CDB41596-FACF-440A-BB6C-8CAD792EC186\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:wan_automation_engine:7.2.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D8C88EE2-5702-4E8B-A144-CB485435FD62\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:wan_automation_engine:7.2.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1BC62844-C608-4DB1-A1AD-C1B55128C560\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:wan_automation_engine:7.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EFF2FFA4-358A-4F33-BC67-A9EF8A30714E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:wan_automation_engine:7.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"53C0BBDE-795E-4754-BB96-4D6D4B5A804F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:wan_automation_engine:7.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7A41E377-16F9-423F-8DC2-F6EDD54E1069\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:wan_automation_engine:7.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F0C2789E-255B-45D9-9469-B5B549A01F53\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EFAFEC61-2128-4BFA-992D-54742BD4911A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:webex_meetings_server:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F12AF70E-2201-4F5D-A929-A1A057B74252\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:snowsoftware:snow_commander:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"8.10.0\", \"matchCriteriaId\": \"A2CBCDC4-02DF-47F4-A01C-7CBCB2FF0163\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:snowsoftware:vm_access_proxy:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.6\", \"matchCriteriaId\": \"C42D44C8-9894-4183-969B-B38FDA1FEDF9\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:bentley:synchro:*:*:*:*:pro:*:*:*\", \"versionStartIncluding\": \"6.1\", \"versionEndExcluding\": \"6.4.3.2\", \"matchCriteriaId\": \"8CD3B3D3-CC14-4278-9914-F7C6E86D3119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:bentley:synchro_4d:*:*:*:*:pro:*:*:*\", \"versionEndExcluding\": \"6.2.4.2\", \"matchCriteriaId\": \"0C5D6BF7-A818-4C7D-A305-91EB622271AC\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:percussion:rhythmyx:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"7.3.2\", \"matchCriteriaId\": \"16E0A04D-30BE-4AB3-85A1-13AF614C425C\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"13.3\", \"matchCriteriaId\": \"E0755E91-2F36-4EC3-8727-E8BF0427E663\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.\"}, {\"lang\": \"es\", \"value\": \"Las caracter\\u00edsticas JNDI de Apache Log4j2 2.0-beta9 hasta 2.15.0 (excluyendo las versiones de seguridad 2.12.2, 2.12.3 y 2.3.1) utilizadas en la configuraci\\u00f3n, los mensajes de registro y los par\\u00e1metros no protegen contra LDAP controlado por un atacante y otros puntos finales relacionados con JNDI. Un atacante que pueda controlar los mensajes de registro o los par\\u00e1metros de los mensajes de registro puede ejecutar c\\u00f3digo arbitrario cargado desde servidores LDAP cuando la sustituci\\u00f3n de la b\\u00fasqueda de mensajes est\\u00e1 habilitada. A partir de la versi\\u00f3n 2.15.0 de log4j, este comportamiento ha sido deshabilitado por defecto. A partir de la versi\\u00f3n 2.16.0 (junto con las versiones 2.12.2, 2.12.3 y 2.3.1), esta funcionalidad se ha eliminado por completo. Tenga en cuenta que esta vulnerabilidad es espec\\u00edfica de log4j-core y no afecta a log4net, log4cxx u otros proyectos de Apache Logging Services\"}]",
"id": "CVE-2021-44228",
"lastModified": "2024-11-21T06:30:38.047",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 10.0, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 6.0}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:C/I:C/A:C\", \"baseScore\": 9.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 8.6, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2021-12-10T10:15:09.143",
"references": "[{\"url\": \"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html\", \"source\": \"security@apache.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html\", \"source\": \"security@apache.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html\", \"source\": \"security@apache.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html\", \"source\": \"security@apache.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html\", \"source\": \"security@apache.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html\", \"source\": \"security@apache.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html\", \"source\": \"security@apache.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/Dec/2\", \"source\": \"security@apache.org\", \"tags\": [\"Exploit\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/Jul/11\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/Mar/23\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/10/1\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/10/2\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/10/3\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/13/1\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/13/2\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/14/4\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/15/3\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/cisagov/log4j-affected-db\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md\", \"source\": \"security@apache.org\", \"tags\": [\"Broken Link\", \"Product\", \"US Government Resource\"]}, {\"url\": \"https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228\", \"source\": \"security@apache.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/\", \"source\": \"security@apache.org\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/\", \"source\": \"security@apache.org\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://logging.apache.org/log4j/2.x/security.html\", \"source\": \"security@apache.org\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/\", \"source\": \"security@apache.org\", \"tags\": [\"Patch\", \"Third Party Advisory\", \"Vendor Advisory\"]}, {\"url\": \"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20211210-0007/\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://support.apple.com/kb/HT213189\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://twitter.com/kurtseifried/status/1469345530182455296\", \"source\": \"security@apache.org\", \"tags\": [\"Broken Link\", \"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2021/dsa-5020\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.kb.cert.org/vuls/id/930724\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}, {\"url\": \"https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html\", \"source\": \"security@apache.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/alert-cve-2021-44228.html\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\", \"source\": \"security@apache.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\", \"source\": \"security@apache.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/Dec/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/Jul/11\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/Mar/23\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/10/1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/10/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/10/3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/13/1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/13/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/14/4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/15/3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/cisagov/log4j-affected-db\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Product\", \"US Government Resource\"]}, {\"url\": \"https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://logging.apache.org/log4j/2.x/security.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\", \"Vendor Advisory\"]}, {\"url\": \"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20211210-0007/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://support.apple.com/kb/HT213189\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://twitter.com/kurtseifried/status/1469345530182455296\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2021/dsa-5020\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.kb.cert.org/vuls/id/930724\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}, {\"url\": \"https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/alert-cve-2021-44228.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}]",
"sourceIdentifier": "security@apache.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"security@apache.org\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}, {\"lang\": \"en\", \"value\": \"CWE-400\"}, {\"lang\": \"en\", \"value\": \"CWE-502\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-917\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-44228\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2021-12-10T10:15:09.143\",\"lastModified\":\"2026-06-17T04:12:05.460\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.\"},{\"lang\":\"es\",\"value\":\"Las caracter\u00edsticas JNDI de Apache Log4j2 2.0-beta9 hasta 2.15.0 (excluyendo las versiones de seguridad 2.12.2, 2.12.3 y 2.3.1) utilizadas en la configuraci\u00f3n, los mensajes de registro y los par\u00e1metros no protegen contra LDAP controlado por un atacante y otros puntos finales relacionados con JNDI. Un atacante que pueda controlar los mensajes de registro o los par\u00e1metros de los mensajes de registro puede ejecutar c\u00f3digo arbitrario cargado desde servidores LDAP cuando la sustituci\u00f3n de la b\u00fasqueda de mensajes est\u00e1 habilitada. A partir de la versi\u00f3n 2.15.0 de log4j, este comportamiento ha sido deshabilitado por defecto. A partir de la versi\u00f3n 2.16.0 (junto con las versiones 2.12.2, 2.12.3 y 2.3.1), esta funcionalidad se ha eliminado por completo. Tenga en cuenta que esta vulnerabilidad es espec\u00edfica de log4j-core y no afecta a log4net, log4cxx u otros proyectos de Apache Logging Services\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Apache Log4j2\",\"versions\":[{\"version\":\"2.0-beta9\",\"lessThan\":\"log4j-core*\",\"versionType\":\"custom\",\"status\":\"affected\",\"changes\":[{\"at\":\"2.3.1\",\"status\":\"unaffected\"},{\"at\":\"2.4\",\"status\":\"affected\"},{\"at\":\"2.12.2\",\"status\":\"unaffected\"},{\"at\":\"2.13.0\",\"status\":\"affected\"},{\"at\":\"2.15.0\",\"status\":\"unaffected\"}]}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:C/I:C/A:C\",\"baseScore\":9.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-04T14:25:34.416117Z\",\"id\":\"CVE-2021-44228\",\"options\":[{\"exploitation\":\"active\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"cisaExploitAdd\":\"2021-12-10\",\"cisaActionDue\":\"2021-12-24\",\"cisaRequiredAction\":\"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.\",\"cisaVulnerabilityName\":\"Apache Log4j2 Remote Code Execution Vulnerability\",\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"},{\"lang\":\"en\",\"value\":\"CWE-400\"},{\"lang\":\"en\",\"value\":\"CWE-502\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-917\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:6bk1602-0aa12-0tp0_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.7.0\",\"matchCriteriaId\":\"BD64FC36-CC7B-4FD7-9845-7EA1DDB0E627\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:6bk1602-0aa12-0tp0:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF99FE8F-40D0-48A8-9A40-43119B259535\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:6bk1602-0aa22-0tp0_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.7.0\",\"matchCriteriaId\":\"D0012304-B1C8-460A-B891-42EBF96504F5\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:6bk1602-0aa22-0tp0:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F3F61BCB-64FA-463C-8B95-8868995EDBC0\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:6bk1602-0aa32-0tp0_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.7.0\",\"matchCriteriaId\":\"B02BCF56-D9D3-4BF3-85A2-D445E997F5EC\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:6bk1602-0aa32-0tp0:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B5A189B7-DDBF-4B84-997F-637CEC5FF12B\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:6bk1602-0aa42-0tp0_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.7.0\",\"matchCriteriaId\":\"4A2DB5BA-1065-467A-8FB6-81B5EC29DC0C\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:6bk1602-0aa42-0tp0:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"035AFD6F-E560-43C8-A283-8D80DAA33025\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:6bk1602-0aa52-0tp0_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.7.0\",\"matchCriteriaId\":\"809EB87E-561A-4DE5-9FF3-BBEE0FA3706E\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:6bk1602-0aa52-0tp0:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4594FF76-A1F8-4457-AE90-07D051CD0DCB\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.0.1\",\"versionEndExcluding\":\"2.3.1\",\"matchCriteriaId\":\"03FA5E81-F9C0-403E-8A4B-E4284E4E7B72\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.4.0\",\"versionEndExcluding\":\"2.12.2\",\"matchCriteriaId\":\"AED3D5EC-DAD5-4E5F-8BBD-B4E3349D84FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.13.0\",\"versionEndExcluding\":\"2.15.0\",\"matchCriteriaId\":\"D31D423D-FC4D-428A-B863-55AF472B80DC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"17854E42-7063-4A55-BF2A-4C7074CC2D60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*\",\"matchCriteriaId\":\"53F32FB2-6970-4975-8BD0-EAE12E9AD03A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B773ED91-1D39-42E6-9C52-D02210DE1A94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF24312D-1A62-482E-8078-7EC24758B710\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8320869-CBF4-4C92-885C-560C09855BFA\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:sppa-t3000_ses3000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"755BA221-33DD-40A2-A517-8574D042C261\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:capital:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2019.1\",\"matchCriteriaId\":\"9AAF12D5-7961-4344-B0CC-BE1C673BFE1F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:capital:2019.1:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"19CB7B44-1877-4739-AECB-3E995ED03FC9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:capital:2019.1:sp1912:*:*:*:*:*:*\",\"matchCriteriaId\":\"A883D9C2-F2A4-459F-8000-EE288DC0DD17\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.4.2\",\"matchCriteriaId\":\"9CD4AC6F-B8D3-4588-B3BD-55C9BAF4AAAC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:desigo_cc_advanced_reports:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AFD64AC-0826-48FB-91B0-B8DF5ECC8775\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB524B33-68E7-46A2-B5CE-BCD9C3194B8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F852C6D-44A0-4CCE-83C7-4501CAD73F9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA61161C-C2E7-4852-963E-E2D3DFBFDC7B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A76AA04A-BB43-4027-895E-D1EACFCDF41B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A6B60F3-327B-49B7-B5E4-F1C60896C9BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4BCF281E-B0A2-49E2-AEF8-8691BDCE08D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:desigo_cc_info_center:5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A87EFCC4-4BC1-4FEA-BAA4-8FF221838EBD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:e-car_operation_center:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2021-12-13\",\"matchCriteriaId\":\"B678380B-E95E-4A8B-A49D-D13B62AA454E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:energy_engage:3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4557476B-0157-44C2-BB50-299E7C7E1E72\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"991B2959-5AA3-4B68-A05A-42D9860FAA9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:energyip:8.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E5948A0-CA31-41DF-85B6-1E6D09E5720B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:energyip:8.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C08D302-EEAC-45AA-9943-3A5F09E29FAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:energyip:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D53BA68C-B653-4507-9A2F-177CF456960F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:energyip_prepay:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.8.0.12\",\"matchCriteriaId\":\"536C7527-27E6-41C9-8ED8-564DD0DC4EA0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.6.2j-398\",\"matchCriteriaId\":\"0E180527-5C36-4158-B017-5BEDC0412FD6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AFDADA98-1CD0-45DA-9082-BFC383F7DB97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:industrial_edge_management:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E33D707F-100E-4DE7-A05B-42467DE75EAC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:industrial_edge_management_hub:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2021-12-13\",\"matchCriteriaId\":\"DD3EAC80-44BE-41D2-8D57-0EE3DBA1E1B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:logo\\\\!_soft_comfort:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2AC8AB52-F4F4-440D-84F5-2776BFE1957A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AF6D774-AC8C-49CA-A00B-A2740CA8FA91\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:mindsphere:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2021-12-16\",\"matchCriteriaId\":\"25FADB1B-988D-4DB9-9138-7542AFDEB672\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2021-12-13\",\"matchCriteriaId\":\"48C6A61B-2198-4B9E-8BCF-824643C81EC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:nx:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BEE2F7A1-8281-48F1-8BFB-4FE0D7E1AEF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2\",\"versionEndExcluding\":\"3.5\",\"matchCriteriaId\":\"C07AFA19-21AE-4C7E-AA95-69599834C0EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.1.3\",\"matchCriteriaId\":\"74D1F4AD-9A60-4432-864F-4505B3C60659\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7ABA5332-8D1E-4129-A557-FCECBAC12827\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:sentron_powermanager:4.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C3AA865-5570-4C8B-99DE-431AD7B163F1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:siguard_dsa:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2\",\"versionEndExcluding\":\"4.4.1\",\"matchCriteriaId\":\"9A4B950B-4527-491B-B111-046DB1CCC037\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83E77D85-0AE8-41D6-AC0C-983A8B73C831\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"02B28A44-3708-480D-9D6D-DDF8C21A15EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"4.16.2.1\",\"matchCriteriaId\":\"2FC0A575-F771-4B44-A0C6-6A5FD98E5134\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D1D6B61-1F17-4008-9DFB-EF419777768E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9772EE3F-FFC5-4611-AD9A-8AD8304291BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF524892-278F-4373-A8A3-02A30FA1AFF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:siveillance_vantage:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F30DE588-9479-46AA-8346-EA433EE83A5F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:siveillance_viewpoint:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4941EAD6-8759-4C72-ABA6-259C0E838216\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge_cam_pro:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5BF2708F-0BD9-41BF-8CB1-4D06C4EFB777\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge_harness_design:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2020\",\"matchCriteriaId\":\"0762031C-DFF1-4962-AE05-0778B27324B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge_harness_design:2020:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"96271088-1D1B-4378-8ABF-11DAB3BB4DDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge_harness_design:2020:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"2595AD24-2DF2-4080-B780-BC03F810B9A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge_harness_design:2020:sp2002:*:*:*:*:*:*\",\"matchCriteriaId\":\"88096F08-F261-4E3E-9EEB-2AB0225CD6F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.70\",\"matchCriteriaId\":\"044994F7-8127-4F03-AA1A-B2AB41D68AF5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:spectrum_power_4:4.70:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A6CB3A8D-9577-41FB-8AC4-0DF8DE6A519C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:spectrum_power_4:4.70:sp7:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B7C211-6339-4AF2-9564-94C7DE52EEB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:spectrum_power_4:4.70:sp8:*:*:*:*:*:*\",\"matchCriteriaId\":\"DBCCBBBA-9A4F-4354-91EE-10A1460BBA3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.30\",\"matchCriteriaId\":\"12F81F6B-E455-4367-ADA4-8A5EC7F4754A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:spectrum_power_7:2.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5EF509E-3799-4718-B361-EFCBA17AEEF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:spectrum_power_7:2.30:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"8CA31645-29FC-4432-9BFC-C98A808DB8CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:spectrum_power_7:2.30:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB424991-0B18-4FFC-965F-FCF4275F56C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1B209EFE-77F2-48CD-A880-ABA0A0A81AB1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:vesys:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2019.1\",\"matchCriteriaId\":\"72D238AB-4A1F-458D-897E-2C93DCD7BA6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:vesys:2019.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9778339A-EA93-4D18-9A03-4EB4CBD25459\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:vesys:2019.1:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"1747F127-AB45-4325-B9A1-F3D12E69FFC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:vesys:2019.1:sp1912:*:*:*:*:*:*\",\"matchCriteriaId\":\"18BBEF7C-F686-4129-8EE9-0F285CE38845\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:vesys:2020.1:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"264C7817-0CD5-4370-BC39-E1DF3E932E16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:vesys:2021.1:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"C7442C42-D493-46B9-BCC2-2C62EAD5B945\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:xpedition_enterprise:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD525494-2807-48EA-AED0-11B9CB5A6A9B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:xpedition_package_integrator:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EDCBF98-A857-48BC-B04D-6F36A1975AA5\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:intel:computer_vision_annotation_tool:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"12A06BF8-E4DC-4389-8A91-8AC7598E0009\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:intel:datacenter_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.1\",\"matchCriteriaId\":\"EAD1E1F3-F06B-4D17-8854-2CDA7E6D872D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:intel:genomics_kernel_library:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"18989EBC-E1FB-473B-83E0-48C8896C2E96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:intel:oneapi_sample_browser:-:*:*:*:*:eclipse:*:*\",\"matchCriteriaId\":\"EDE66B6C-25E5-49AE-B35F-582130502222\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:intel:secure_device_onboard:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEE177-D117-478C-8EAD-9606DEDF9FD5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:intel:system_studio:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC619106-991C-413A-809D-C2410EBA4CDB\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A930E247-0B43-43CB-98FF-6CE7B8189835\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80E516C0-98A4-4ADE-B69F-66A772E2BAAA\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.0.13\",\"matchCriteriaId\":\"CA7D45EF-18F7-43C6-9B51-ABAB7B0CA3CD\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*\",\"matchCriteriaId\":\"F3E0B672-3E06-4422-B2A4-0BD073AEC2A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*\",\"matchCriteriaId\":\"3A756737-1CC4-42C2-A4DF-E1C893B4E2D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*\",\"matchCriteriaId\":\"B55E8D50-99B4-47EC-86F9-699B67D473CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:brocade_san_navigator:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25FA7A4D-B0E2-423E-8146-E221AE2D6120\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:cloud_insights:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"26FCA75B-4282-4E0F-95B4-640A82C8E91C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"197D0D80-6702-4B61-B681-AFDBA7D69067\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1BE6C1F-2565-4E97-92AA-16563E5660A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:ontap_tools:-:*:*:*:*:vmware_vsphere:*:*\",\"matchCriteriaId\":\"CBCC384C-5DF0-41AB-B17B-6E9B6CAE8065\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:vmware_vsphere:*:*\",\"matchCriteriaId\":\"F3A48D58-4291-4D3C-9CEA-BF12183468A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:solidfire_\\\\\u0026_hci_storage_node:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D452B464-1200-4B72-9A89-42DC58486191\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:solidfire_enterprise_sds:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D18075A-E8D6-48B8-A7FA-54E336A434A2\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:advanced_malware_protection_virtual_private_cloud_appliance:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.5.4\",\"matchCriteriaId\":\"4E52AF19-0158-451B-8E36-02CB6406083F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:automated_subsea_tuning:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.1.0\",\"matchCriteriaId\":\"CB21CFB4-4492-4C5D-BD07-FFBE8B5D92B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:broadworks:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2021.11_1.162\",\"matchCriteriaId\":\"97426511-9B48-46F5-AC5C-F9781F1BAE2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:business_process_automation:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.0.000.115\",\"matchCriteriaId\":\"82306B9F-AE97-4E29-A8F7-2E5BA52998A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:business_process_automation:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.1.000.000\",\"versionEndExcluding\":\"3.1.000.044\",\"matchCriteriaId\":\"4C903C85-DC0F-47D8-B8BE-7A666877B017\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:business_process_automation:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2.000.000\",\"versionEndExcluding\":\"3.2.000.009\",\"matchCriteriaId\":\"E4C6F9E0-5DCE-431D-AE7E-B680AC1F9332\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:cloud_connect:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"12.6\\\\(1\\\\)\",\"matchCriteriaId\":\"52CF6199-8028-4076-952B-855984F30129\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:cloudcenter:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.10.0.16\",\"matchCriteriaId\":\"622BB8D9-AC81-4C0F-A5C5-C5E51F0BC0D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:cloudcenter_cost_optimizer:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.5.2\",\"matchCriteriaId\":\"38FB3CE1-5F62-4798-A825-4E3DB07E868F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:cloudcenter_suite_admin:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.3.1\",\"matchCriteriaId\":\"29CDB878-B085-448E-AB84-25B1E2D024F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:cloudcenter_workload_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.5.2\",\"matchCriteriaId\":\"C25FDA96-9490-431F-B8B6-CC2CC272670E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:common_services_platform_collector:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.9.1.3\",\"matchCriteriaId\":\"51CD9E4C-9385-435C-AD18-6C36C8DF7B65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:common_services_platform_collector:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.10.0\",\"versionEndExcluding\":\"2.10.0.1\",\"matchCriteriaId\":\"FC0AC4C1-CB06-4084-BFBB-5B702C384C53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:connected_mobile_experiences:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3871EBD2-F270-435A-B98C-A282E1C52693\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:contact_center_domain_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"12.5\\\\(1\\\\)\",\"matchCriteriaId\":\"8D4DF34B-E8C2-41C8-90E2-D119B50E4E7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:contact_center_management_portal:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"12.5\\\\(1\\\\)\",\"matchCriteriaId\":\"C8EF64DA-73E4-4E5E-8F9A-B837C947722E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:crosswork_data_gateway:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.0.2\",\"matchCriteriaId\":\"66E1E4FC-0B6E-4CFA-B003-91912F8785B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:crosswork_data_gateway:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1B2390C3-C319-4F05-8CF0-0D30F9931507\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:crosswork_network_controller:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.0.1\",\"matchCriteriaId\":\"C154491E-06C7-48B0-AC1D-89BBDBDB902E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:crosswork_network_controller:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E98EC48-0CED-4E02-9CCB-06EF751F2BDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:crosswork_optimization_engine:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.0.1\",\"matchCriteriaId\":\"C569DC2A-CFF6-4E13-A50C-E215A4F96D99\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:crosswork_optimization_engine:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"258A51AC-6649-4F67-A842-48A7AE4DCEE1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:crosswork_platform_infrastructure:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.0.1\",\"matchCriteriaId\":\"8DC22505-DE11-4A1B-8C06-1E306419B031\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:crosswork_platform_infrastructure:4.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E31AC54-B928-48B5-8293-F5F4A7A8C293\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:crosswork_zero_touch_provisioning:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.0.1\",\"matchCriteriaId\":\"5B8AE870-6FD0-40D2-958B-548E2D7A7B75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:crosswork_zero_touch_provisioning:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"68E7D83B-B6AC-45B1-89A4-D18D7A6018DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:customer_experience_cloud_agent:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.12.1\",\"matchCriteriaId\":\"17660B09-47AA-42A2-B5FF-8EBD8091C661\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:cyber_vision_sensor_management_extension:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.0.3\",\"matchCriteriaId\":\"FBEF9A82-16AE-437A-B8CF-CC7E9B6C4E44\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:data_center_network_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"11.3\\\\(1\\\\)\",\"matchCriteriaId\":\"843147AE-8117-4FE9-AE74-4E1646D55642\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:data_center_network_manager:11.3\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7EB871C9-CA14-4829-AED3-CC2B35E99E92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:dna_center:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.1.2.8\",\"matchCriteriaId\":\"4FF8A83D-A282-4661-B133-213A8838FB27\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:dna_center:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.2.2.0\",\"versionEndExcluding\":\"2.2.2.8\",\"matchCriteriaId\":\"139CDAA5-63E9-4E56-AF72-745BD88E4B49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:dna_center:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.2.3.0\",\"versionEndExcluding\":\"2.2.3.4\",\"matchCriteriaId\":\"01FD99C4-BCB1-417E-ADCE-73314AD2E857\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:dna_spaces\\\\:_connector:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.5\",\"matchCriteriaId\":\"9031BE8A-646A-4581-BDE5-750FB0CE04CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:emergency_responder:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"11.5\\\\(4\\\\)\",\"matchCriteriaId\":\"15BED3E2-46FF-4E58-8C5D-4D8FE5B0E527\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:enterprise_chat_and_email:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"12.0\\\\(1\\\\)\",\"matchCriteriaId\":\"7C950436-2372-4C4B-9B56-9CB48D843045\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"4.1.1\",\"matchCriteriaId\":\"0B61F186-D943-4711-B3E0-875BB570B142\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"12.6\\\\(1\\\\)\",\"matchCriteriaId\":\"2A285C40-170D-4C95-8031-2C6E4D5FB1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.6\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C0F02B5-AA2A-48B2-AE43-38B45532C563\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:fog_director:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"830BDB28-963F-46C3-8D50-638FDABE7F64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.4.0\",\"matchCriteriaId\":\"54553C65-6BFA-40B1-958D-A4E3289D6B1D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:2.4.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"439948AD-C95D-4FC3-ADD1-C3D241529F12\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.3.2.1\",\"matchCriteriaId\":\"9C2002AE-0F3C-4A06-9B9A-F77A9F700EB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:intersight_virtual_appliance:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.0.9-361\",\"matchCriteriaId\":\"596A986D-E7DC-4FC4-A776-6FE87A91D7E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:iot_operations_dashboard:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD93434E-8E75-469C-B12B-7E2B6EDCAA79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_assurance_engine:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.0.2\",\"matchCriteriaId\":\"78684844-4974-41AD-BBC1-961F60025CD2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.3.5.1\",\"matchCriteriaId\":\"3A00D235-FC9C-4EB7-A16C-BB0B09802E61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4\",\"versionEndExcluding\":\"5.4.5.2\",\"matchCriteriaId\":\"C60FDD1B-898E-4FCB-BDE2-45A7CBDBAF4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.5.4.1\",\"matchCriteriaId\":\"E7A33E5F-BBC7-4917-9C63-900248B546D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.6\",\"versionEndExcluding\":\"5.6.3.1\",\"matchCriteriaId\":\"12D98A7C-4992-4E58-A6BD-3D8173C8F2B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:nexus_dashboard:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.1.2\",\"matchCriteriaId\":\"E2DDC1AF-31B5-4F05-B84F-8FD23BE163DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:nexus_insights:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.0.2\",\"matchCriteriaId\":\"A4540CF6-D33E-4D33-8608-11129D6591FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:optical_network_controller:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.1.0\",\"matchCriteriaId\":\"129A7615-99E7-41F8-8EBC-CEDA10AD89AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:packaged_contact_center_enterprise:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"11.6\",\"matchCriteriaId\":\"5F46A7AC-C133-442D-984B-BA278951D0BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:packaged_contact_center_enterprise:11.6\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1A75AB6-C3A7-4299-B35A-46A4BCD00816\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:paging_server:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.4.1\",\"matchCriteriaId\":\"0A73E888-C8C2-4AFD-BA60-566D45214BCA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_service_catalog:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"12.1\",\"matchCriteriaId\":\"4B0D0FD0-ABC6-465F-AB8D-FA8788B1B2DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"20.3.4.1\",\"matchCriteriaId\":\"D673F6F7-C42A-4538-96F0-34CB4F0CB080\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"20.4\",\"versionEndExcluding\":\"20.4.2.1\",\"matchCriteriaId\":\"FD374819-3CED-4260-90B6-E3C1333EAAD2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"20.5\",\"versionEndExcluding\":\"20.5.1.1\",\"matchCriteriaId\":\"D2D89973-94AF-4BE7-8245-275F3FEB30F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"20.6\",\"versionEndExcluding\":\"20.6.2.1\",\"matchCriteriaId\":\"91A9A889-2C2B-4147-8108-C35291761C15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:smart_phy:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.2.1\",\"matchCriteriaId\":\"D0EEA1EC-C63C-4C7D-BFAE-BA4556332242\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:ucs_central:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.0\\\\(1p\\\\)\",\"matchCriteriaId\":\"ACE22D97-42FA-4179-99E5-C2EE582DB7FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.8.2.0\",\"matchCriteriaId\":\"F6B5DB6D-9E7D-4403-8028-D7DA7493716B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*\",\"versionEndExcluding\":\"11.5\\\\(1\\\\)\",\"matchCriteriaId\":\"B98D7AD5-0590-43FB-8AC0-376C9C500C15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*\",\"versionEndExcluding\":\"11.5\\\\(1\\\\)\",\"matchCriteriaId\":\"D9DA1900-9972-4DFD-BE2E-74DABA1ED9A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"42A41C41-A370-4C0E-A49D-AD42B2F3FB5C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1\\\\):*:*:*:-:*:*:*\",\"matchCriteriaId\":\"7E958AFF-185D-4D55-B74B-485BEAEC42FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1\\\\):*:*:*:session_management:*:*:*\",\"matchCriteriaId\":\"F770709C-FFB2-4A4E-A2D8-2EAA23F2E87C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1\\\\)su3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B85B81F9-8837-426E-8639-AB0712CD1A96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"11.5\\\\(1\\\\)\",\"matchCriteriaId\":\"C1CCCD27-A247-4720-A2FE-C8ED55D1D0DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"34D89C42-AAD9-4B04-9F95-F77681E39553\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_contact_center_enterprise:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"11.6\\\\(2\\\\)\",\"matchCriteriaId\":\"897C8893-B0B6-4D6E-8D70-31B421D80B9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_contact_center_enterprise:11.6\\\\(2\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"91D62A73-21B5-4D16-A07A-69AED2D40CC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_contact_center_express:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"12.5\\\\(1\\\\)\",\"matchCriteriaId\":\"B0492049-D3AC-4512-A4BF-C9C26DA72CB0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_customer_voice_portal:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"11.6\",\"matchCriteriaId\":\"3868A8AA-6660-4332-AB0C-089C150D00E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_customer_voice_portal:11.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"58BD72D6-4A79-49C9-9652-AB0136A591FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_customer_voice_portal:12.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A32761FD-B435-4E51-807C-2B245857F90E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_customer_voice_portal:12.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"154F7F71-53C5-441C-8F5C-0A82CB0DEC43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_intelligence_center:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"12.6\\\\(1\\\\)\",\"matchCriteriaId\":\"8BD68514-1566-4E7C-879C-76D35084F7BE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"11.5\\\\(1\\\\)\",\"matchCriteriaId\":\"65FD3873-2663-4C49-878F-7C65D4B8E455\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:video_surveillance_operations_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.14.4\",\"matchCriteriaId\":\"0886FB04-24AA-4995-BA53-1E44F94E114E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:virtual_topology_system:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.6.7\",\"matchCriteriaId\":\"C61805C1-1F73-462C-A9CA-BB0CA4E57D0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:virtualized_infrastructure_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.2.0\",\"matchCriteriaId\":\"5EB39834-0F6D-4BD7-AFEC-DD8BEE46DA50\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:virtualized_infrastructure_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.4.0\",\"versionEndExcluding\":\"3.4.4\",\"matchCriteriaId\":\"0B78DD21-15F2-47A4-8A99-6DB6756920AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:virtualized_voice_browser:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"12.5\\\\(1\\\\)\",\"matchCriteriaId\":\"7C6222EB-36E1-4CD5-BD69-5A921ED5DA6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:wan_automation_engine:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.3.0.2\",\"matchCriteriaId\":\"C200CABD-F91B-49C4-A262-C56370E44B4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.0\",\"matchCriteriaId\":\"DE22BE9B-374E-43DC-BA91-E3B9699A4C7C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:3.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"61D1081F-87E8-4E8B-BEBD-0F239E745586\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D138973-02B0-4FEC-A646-FF1278DA1EDF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release2:*:*:*:*:*:*\",\"matchCriteriaId\":\"30B55A5B-8C5E-4ECB-9C85-A8A3A3030850\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3:*:*:*:*:*:*\",\"matchCriteriaId\":\"14DBEC10-0641-441C-BE15-8F72C1762DCE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3:-:*:*:*:*:*\",\"matchCriteriaId\":\"205C1ABA-2A4F-480F-9768-7E3EC43B03F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_security_patch4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D36FE453-C43F-448B-8A59-668DE95468C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_security_patch5:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8DF0944-365F-4149-9059-BDFD6B131DC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_service_pack_2:*:*:*:*:*:*\",\"matchCriteriaId\":\"6B37AA08-13C7-4FD0-8402-E344A270C8F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_service_pack_3:*:*:*:*:*:*\",\"matchCriteriaId\":\"2AA56735-5A5E-4D8C-B09D-DBDAC2B5C8E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release4:*:*:*:*:*:*\",\"matchCriteriaId\":\"4646849B-8190-4798-833C-F367E28C1881\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:4.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D6CF856-093A-4E89-A71D-50A2887C265B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B36A9043-0621-43CD-BFCD-66529F937859\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release2:*:*:*:*:*:*\",\"matchCriteriaId\":\"8842B42E-C412-4356-9F54-DFC53B683D3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release3:*:*:*:*:*:*\",\"matchCriteriaId\":\"D25BC647-C569-46E5-AD45-7E315EBEB784\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:workload_optimization_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.2.1\",\"matchCriteriaId\":\"B468EDA1-CDEF-44D4-9D62-C433CF27F631\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:unified_sip_proxy:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.2.1v2\",\"matchCriteriaId\":\"9E4905E2-2129-469C-8BBD-EDA258815E2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:unified_workforce_optimization:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"11.5\\\\(1\\\\)\",\"matchCriteriaId\":\"EC86AC6C-7C08-4EB9-A588-A034113E4BB1\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_1010:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FFE3880-4B85-4E23-9836-70875D5109F7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_1120:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"727A02E8-40A1-4DFE-A3A2-91D628D3044F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_1140:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"19F6546E-28F4-40DC-97D6-E0E023FE939B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_1150:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB3B0EC3-4654-4D90-9D41-7EC2AD1DDF99\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_2110:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"52D96810-5F79-4A83-B8CA-D015790FCF72\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_2120:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16FE2945-4975-4003-AE48-7E134E167A7F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_2130:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCE7122A-5AA7-4ECD-B024-E27C9D0CFB7B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_2140:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"976901BF-C52C-4F81-956A-711AF8A60140\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_4110:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0CBC7F5-7767-43B6-9384-BE143FCDBD7F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_4112:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"957D64EB-D60E-4775-B9A8-B21CA48ED3B1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_4115:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A694AD51-9008-4AE6-8240-98B17AB527EE\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_4120:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"38AE6DC0-2B03-4D36-9856-42530312CC46\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_4125:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"71DCEF22-ED20-4330-8502-EC2DD4C9838F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_4140:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3DB2822B-B752-4CD9-A178-934957E306B4\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_4145:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"81F4868A-6D62-479C-9C19-F9AABDBB6B24\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_4150:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"65378F3A-777C-4AE2-87FB-1E7402F9EA1B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07DAFDDA-718B-4B69-A524-B0CEB80FE960\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:fxos:6.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"82C8AD48-0130-4C20-ADEC-697668E2293B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:fxos:6.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E75EF7C-8D71-4D70-91F0-74FC99A90CC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:fxos:6.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2DB7EE7D-8CB4-4804-9F9D-F235608E86E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:fxos:6.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"77571973-2A94-4E15-AC5B-155679C3C565\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:fxos:6.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA405A50-3F31-48ED-9AF1-4B02F5B367DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:fxos:6.7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3753953-04E8-4382-A6EC-CD334DD83CF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:fxos:7.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4A5F89F-1296-4A0F-A36D-082A481F190F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:fxos:7.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F50F48AF-44FF-425C-9685-E386F956C901\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:automated_subsea_tuning:02.01.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4D28E76-56D4-4C9A-A660-7CD7E0A1AC9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:broadworks:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD975A0E-00A6-475E-9064-1D64E4291499\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:cloudcenter_suite:4.10.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C6EE38C-5396-4ACE-8FA3-B147251C6D9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:cloudcenter_suite:5.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5569201-9A97-481E-96FD-7F41697BD5EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:cloudcenter_suite:5.4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"10A33C3D-5890-430B-9284-3E28F03ADAE8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:cloudcenter_suite:5.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"777C92AC-A9B6-4204-99D1-EA7E3EE366A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:cloudcenter_suite:5.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A908014-8E8B-477D-9E81-3801F43723BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:common_services_platform_collector:002.009\\\\(000.000\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BAC1A386-04C7-45B2-A883-1CD9AB60C14B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:common_services_platform_collector:002.009\\\\(000.001\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F0F1639-D69E-473A-8926-827CCF73ACC9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:common_services_platform_collector:002.009\\\\(000.002\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4FDF900-E9D6-454A-BF6B-821620CA59F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:common_services_platform_collector:002.009\\\\(001.000\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1859BD43-BA2B-45A5-B523-C6BFD34C7B01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:common_services_platform_collector:002.009\\\\(001.001\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EBC145C-9A2F-4B76-953E-0F690314511C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:common_services_platform_collector:002.009\\\\(001.002\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"158B7A53-FEC1-4B42-A1E2-E83E99564B07\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:common_services_platform_collector:002.010\\\\(000.000\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3A378971-1A08-4914-B012-8E24DCDEFC68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:crosswork_network_automation:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F429F37-3576-4D8A-9901-359D65EC3CF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:crosswork_network_automation:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F526DEF1-4A3E-4FE1-8153-E9252DAE5B92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:crosswork_network_automation:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C19679D0-F4DC-4130-AFFD-692E5130531A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:crosswork_network_automation:4.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"60D2FBF3-D8AB-41F0-B170-9E56FBF7E2F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:crosswork_network_automation:4.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F60324DD-8450-4B14-A7A1-0D5EA5163580\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:cx_cloud_agent:001.012:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"12F6DFD1-273B-4292-A22C-F2BE0DD3FB3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:cyber_vision:4.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"13EA024C-97A4-4D33-BC3E-51DB77C51E76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:cyber_vision_sensor_management_extension:4.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"85289E35-C7C2-46D0-9BDC-10648DD2C86F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:dna_center:2.2.2.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"17282822-C082-4FBC-B46D-468DCF8EF6B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:dna_spaces:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5463DA6-5D44-4C32-B46C-E8A2ADD7646B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:dna_spaces_connector:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"54A237CF-A439-4114-AF81-D75582F29573\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:emergency_responder:11.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A37D19BF-E4F5-4AF4-8942-0C3B62C4BF2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:emergency_responder:11.5\\\\(4.65000.14\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF25688B-6659-4C7C-866D-79AA1166AD7A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:emergency_responder:11.5\\\\(4.66000.14\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"47B70741-90D9-4676-BF16-8A21E147F532\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:enterprise_chat_and_email:12.0\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED862A1B-E558-4D44-839C-270488E735BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:enterprise_chat_and_email:12.5\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2678AF98-1194-4810-9933-5BA50E409F88\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:enterprise_chat_and_email:12.6\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"37E7DEBD-9E47-4D08-86BC-D1B013450A98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:evolved_programmable_network_manager:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A935862-18F7-45FE-B647-1A9BA454E304\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:evolved_programmable_network_manager:3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"69594997-2568-4C10-A411-69A50BFD175F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:evolved_programmable_network_manager:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EC39E2D-C47B-4311-BC7B-130D432549F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:evolved_programmable_network_manager:4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE5E6CBE-D82C-4001-87CB-73DF526F0AB1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:evolved_programmable_network_manager:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"460E6456-0E51-45BC-868E-DEEA5E3CD366\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:evolved_programmable_network_manager:5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7F58659-A318-42A0-83C5-8F09FCD78982\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.5\\\\(1\\\\):su1:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8A49E46-8501-4697-A17A-249A7D9F5A0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.5\\\\(1\\\\):su2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D81E7A9-0C2B-4603-91F0-ABF2380DBBA3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.6\\\\(1\\\\):-:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DFCE723-9359-40C7-BA35-B71BDF8E3CF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.6\\\\(1\\\\):es01:*:*:*:*:*:*\",\"matchCriteriaId\":\"28B1524E-FDCA-4570-86DD-CE396271B232\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.6\\\\(1\\\\):es02:*:*:*:*:*:*\",\"matchCriteriaId\":\"74DC6F28-BFEF-4D89-93D5-10072DAC39C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.6\\\\(1\\\\):es03:*:*:*:*:*:*\",\"matchCriteriaId\":\"BA1D60D7-1B4A-4EEE-A26C-389D9271E005\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firepower_threat_defense:6.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D726F07-06F1-4B0A-B010-E607E0C2A280\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firepower_threat_defense:6.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3ED58B0E-FCC7-48E3-A5C0-6CC54A38BAE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firepower_threat_defense:6.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2DF0B07-8C2A-4341-8AFF-DE7E5E5B3A43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firepower_threat_defense:6.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"41E168ED-D664-4749-805E-77644407EAFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firepower_threat_defense:6.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCD69468-8067-4A5D-B2B0-EC510D889AA0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firepower_threat_defense:6.7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"85F22403-B4EE-4303-9C94-915D3E0AC944\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firepower_threat_defense:7.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BBCA75A6-0A3E-4393-8884-9F3CE190641E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firepower_threat_defense:7.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D619BF54-1BA9-45D0-A876-92D7010088A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:002.004\\\\(000.914\\\\):-:*:*:*:*:*:*\",\"matchCriteriaId\":\"808F8065-BD3A-4802-83F9-CE132EDB8D34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:002.006\\\\(000.156\\\\):-:*:*:*:*:*:*\",\"matchCriteriaId\":\"B236B13E-93B9-424E-926C-95D3DBC6CA5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:002.007\\\\(000.356\\\\):-:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A63CC83-0A6E-4F33-A1BE-214A33B51518\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:003.000\\\\(000.458\\\\):-:*:*:*:*:*:*\",\"matchCriteriaId\":\"37DB7759-6529-46DE-B384-10F060D86A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:003.001\\\\(000.518\\\\):-:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C640AD9-146E-488A-B166-A6BB940F97D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:003.002\\\\(000.116\\\\):-:*:*:*:*:*:*\",\"matchCriteriaId\":\"DAC1FA7E-CB1B-46E5-A248-ABACECFBD6E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:integrated_management_controller_supervisor:002.003\\\\(002.000\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C3BD5AF-9FC1-494B-A676-CC3D4B8EAC8D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:integrated_management_controller_supervisor:2.3.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F477CACA-2AA0-417C-830D-F2D3AE93153A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:intersight_virtual_appliance:1.0.9-343:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E3BE5E1-A6B6-46C7-B93B-8A9F5AEA2731\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:mobility_services_engine:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"04E0BB7B-0716-4DBD-89B9-BA11AAD77C00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_assurance_engine:6.0\\\\(2.1912\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"64C98A76-0C31-45E7-882B-35AE0D2C5430\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.0\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"379F8D86-BE87-4250-9E85-494D331A0398\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.1\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"71F69E51-E59D-4AE3-B242-D6D2CFDB3F46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.2\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"578DA613-8E15-4748-A4B7-646415449609\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.3\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"544EFAD6-CE2F-4E1D-9A00-043454B72889\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.4\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E16DF9C-3B64-4220-82B6-6E20C7807BAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.5\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9CD5B8A-9846-48F1-9495-77081E44CBFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.5\\\\(2\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"68E6CD49-6F71-4E17-B046-FBE91CE91CB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.5\\\\(3\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0BDD8018-7E77-4C89-917E-ACDC678A7DE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_insights_for_data_center:6.0\\\\(2.1914\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7D39156-A47D-405E-8C02-CAE7D637F99A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:network_services_orchestrator:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5426FC59-411D-4963-AFEF-5B55F68B8958\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:optical_network_controller:1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"810E9A92-4302-4396-94D3-3003947DB2A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:paging_server:8.3\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"522C36A5-7520-4368-BD92-9AB577756493\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:paging_server:8.4\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CB2EC4BE-FFAF-4605-8A96-2FEF35975540\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:paging_server:8.5\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA1D3C2A-E5FA-400C-AC01-27A3E5160477\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:paging_server:9.0\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"63B27050-997B-4D54-8E5A-CE9E33904318\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:paging_server:9.0\\\\(2\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5ABF05B8-1B8A-4CCF-A1AD-D8602A247718\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:paging_server:9.1\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F74580D-0011-4ED9-9A00-B4CDB6685154\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:paging_server:12.5\\\\(2\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"17A3C22E-1980-49B6-8985-9FA76A77A836\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:paging_server:14.0\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1AB42DC-CE58-448A-A6B5-56F31B15F4A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_service_catalog:12.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9DC32B55-0C76-4669-8EAD-DCC16355E887\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:sd-wan_vmanage:20.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6CDA737F-337E-4C30-B68D-EF908A8D6840\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:sd-wan_vmanage:20.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9DC5A89C-CCCF-49EC-B4FC-AB98ACB79233\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:sd-wan_vmanage:20.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4BA4F513-CBA1-4523-978B-D498CEDAE0CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:sd-wan_vmanage:20.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6C53C6FD-B98E-4F7E-BA4D-391C90CF9E83\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:sd-wan_vmanage:20.6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D00F6719-2C73-4D8D-8505-B9922E8A4627\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:sd-wan_vmanage:20.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFE9210F-39C5-4828-9608-6905C1D378D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:sd-wan_vmanage:20.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1CEDCE4-CFD1-434B-B157-D63329CBA24A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:smart_phy:3.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33660EB8-2984-4258-B8AD-141B7065C85E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:smart_phy:3.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0ACA346D-5103-47F0-8BD9-7A8AD9B92E98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:smart_phy:3.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A38BDF03-23C8-4BB6-A44D-68818962E7CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:smart_phy:3.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3104C099-FEDA-466B-93CC-D55F058F7CD3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:smart_phy:3.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"890EA1C7-5990-4C71-857F-197E6F5B4089\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:smart_phy:21.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"56F21CF4-83FE-4529-9871-0FDD70D3095E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:ucs_central_software:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9331834-9EAD-46A1-9BD4-F4027E49D0C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1a\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0E707E44-12CD-46C3-9124-639D0265432E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1b\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2FEE8482-DB64-4421-B646-9E5F560D1712\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1c\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4385CE6E-6283-4621-BBD9-8E66E2A34843\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1d\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A6CDBD4-889B-442D-B272-C8E9A1B6AEC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1e\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF1E59F9-CF4F-4EFB-872C-5F503A04CCF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1f\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1782219F-0C3D-45B7-80C7-D1DAA70D90B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1g\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DDAB3BAD-1EC6-4101-A58D-42DA48D04D0C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1h\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F7AA674-6BC2-490F-8D8A-F575B11F4BE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1k\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6945C4DE-C070-453E-B641-2F5B9CFA3B6D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:ucs_central_software:2.0\\\\(1l\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DAB8C7C0-D09B-4232-A88E-57D25AF45457\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1.17900.52\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ACEDB7B4-EBD4-4A37-9EE3-07EE3B46BE44\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1.18119.2\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"820D579C-AA45-4DC1-945A-748FFCD51CA2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1.18900.97\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7B23A9A6-CD04-4D76-BE3F-AFAFBB525F5E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1.21900.40\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A44E6007-7A3A-4AD3-9A65-246C59B73FB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager:11.5\\\\(1.22900.28\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D508E51-4075-4E34-BB7C-65AF9D56B49F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager_im_\\\\\u0026_presence_service:11.5\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"376D06D5-D68E-4FF0-97E5-CBA2165A05CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_communications_manager_im_\\\\\u0026_presence_service:11.5\\\\(1.22900.6\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"18ED6B8F-2064-4BBA-A78D-4408F13C724D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_computing_system:006.008\\\\(001.000\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"94091FE3-AB88-4CF5-8C4C-77B349E716A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_contact_center_enterprise:11.6\\\\(2\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"91D62A73-21B5-4D16-A07A-69AED2D40CC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_contact_center_enterprise:12.0\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"53F1314A-9A2C-43DC-8203-E4654EF013CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_contact_center_enterprise:12.5\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0ADE468B-8F0C-490D-BB4C-358D947BA8E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_contact_center_enterprise:12.6\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"32FEE78D-309E-491D-9AB6-98005F1CBF49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_contact_center_enterprise:12.6\\\\(2\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"878D9901-675D-4444-B094-0BA505E7433F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_contact_center_express:12.5\\\\(1\\\\):-:*:*:*:*:*:*\",\"matchCriteriaId\":\"66E25EE4-AB7B-42BF-A703-0C2E83E83577\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_contact_center_express:12.5\\\\(1\\\\):su1:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8F35520-F04A-4863-A1BC-0EDD2D1804F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_contact_center_express:12.6\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF9855FD-7747-4D9E-9542-703B1EC9A382\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_contact_center_express:12.6\\\\(2\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E07AF386-D8A5-44F5-A418-940C9F88A36A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_contact_center_management_portal:12.6\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"113C77DA-AC22-4D67-9812-8510EFC0A95F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_customer_voice_portal:11.6\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4BE221AB-A3B0-4CFF-9BC0-777773C2EF63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_customer_voice_portal:12.0\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"15941265-1E7E-4C3E-AF1D-027C5E0D3141\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_customer_voice_portal:12.5\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"54AA2B0C-92A1-4B53-88D7-6E31120F5041\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_customer_voice_portal:12.6\\\\(1\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F9BD7207-85FB-4484-8720-4D11F296AC10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_intelligence_center:12.6\\\\(1\\\\):-:*:*:*:*:*:*\",\"matchCriteriaId\":\"62E009C4-BE3E-4A14-91EF-8F667B2220A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_intelligence_center:12.6\\\\(1\\\\):es01:*:*:*:*:*:*\",\"matchCriteriaId\":\"088512E1-434D-4685-992E-192A98ECAD9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_intelligence_center:12.6\\\\(1\\\\):es02:*:*:*:*:*:*\",\"matchCriteriaId\":\"50A7BBC6-077C-4182-AA7A-577C4AAC3CD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_intelligence_center:12.6\\\\(2\\\\):-:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0536F45-3A49-4F93-942E-AF679DFC7017\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_sip_proxy:010.000\\\\(000\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D54794B-6CD5-46D7-B9E9-62A642143562\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_sip_proxy:010.000\\\\(001\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE844DCA-FF52-43F5-BDD9-836A812A8CFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_sip_proxy:010.002\\\\(000\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B261EB-CA63-4796-BD15-A6770FD68B34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_sip_proxy:010.002\\\\(001\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"29F9067A-B86C-4A6B-ACB7-DB125E04B795\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_workforce_optimization:11.5\\\\(1\\\\):sr7:*:*:*:*:*:*\",\"matchCriteriaId\":\"FAC4CC92-8BA0-4D96-9C48-5E311CDED53F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unity_connection:11.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F2437A5-217A-4CD1-9B72-A31BDDC81F42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unity_connection:11.5\\\\(1.10000.6\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C3CFF0D-BD70-4353-AE2F-6C55F8DE56A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:video_surveillance_manager:7.14\\\\(1.26\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2CE47760-0E71-4FCA-97D1-CF0BB71CAC17\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:video_surveillance_manager:7.14\\\\(2.26\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"89B2D4F5-CB86-4B25-8C14-CED59E8A3F22\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:video_surveillance_manager:7.14\\\\(3.025\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B150B636-6267-4504-940F-DC37ABEFB082\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:video_surveillance_manager:7.14\\\\(4.018\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D00B9911-A7CA-467E-B7A3-3AF31828D5D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:virtual_topology_system:2.6.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B67C08C3-412F-4B7F-B98C-EEAEE77CBE4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:wan_automation_engine:7.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D428C9B-53E1-4D26-BB4D-57FDE02FA613\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:wan_automation_engine:7.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CDB41596-FACF-440A-BB6C-8CAD792EC186\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:wan_automation_engine:7.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8C88EE2-5702-4E8B-A144-CB485435FD62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:wan_automation_engine:7.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1BC62844-C608-4DB1-A1AD-C1B55128C560\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:wan_automation_engine:7.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFF2FFA4-358A-4F33-BC67-A9EF8A30714E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:wan_automation_engine:7.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"53C0BBDE-795E-4754-BB96-4D6D4B5A804F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:wan_automation_engine:7.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A41E377-16F9-423F-8DC2-F6EDD54E1069\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:wan_automation_engine:7.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F0C2789E-255B-45D9-9469-B5B549A01F53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFAFEC61-2128-4BFA-992D-54742BD4911A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:webex_meetings_server:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F12AF70E-2201-4F5D-A929-A1A057B74252\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:snowsoftware:snow_commander:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.10.0\",\"matchCriteriaId\":\"A2CBCDC4-02DF-47F4-A01C-7CBCB2FF0163\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:snowsoftware:vm_access_proxy:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.6\",\"matchCriteriaId\":\"C42D44C8-9894-4183-969B-B38FDA1FEDF9\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:bentley:synchro:*:*:*:*:pro:*:*:*\",\"versionStartIncluding\":\"6.1\",\"versionEndExcluding\":\"6.2.4.2\",\"matchCriteriaId\":\"452D8730-F273-4AB4-9221-E82EC2CAAFD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:bentley:synchro_4d:*:*:*:*:pro:*:*:*\",\"versionEndExcluding\":\"6.4.3.2\",\"matchCriteriaId\":\"F2EF5054-EECB-4489-B27A-AACB96B25B97\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:percussion:rhythmyx:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"7.3.2\",\"matchCriteriaId\":\"16E0A04D-30BE-4AB3-85A1-13AF614C425C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"13.3\",\"matchCriteriaId\":\"E0755E91-2F36-4EC3-8727-E8BF0427E663\"}]}]}],\"references\":[{\"url\":\"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html\",\"source\":\"security@apache.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html\",\"source\":\"security@apache.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html\",\"source\":\"security@apache.org\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html\",\"source\":\"security@apache.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html\",\"source\":\"security@apache.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html\",\"source\":\"security@apache.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html\",\"source\":\"security@apache.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html\",\"source\":\"security@apache.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://seclists.org/fulldisclosure/2022/Dec/2\",\"source\":\"security@apache.org\",\"tags\":[\"Exploit\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2022/Jul/11\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2022/Mar/23\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/12/10/1\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/12/10/2\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/12/10/3\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/12/13/1\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/12/13/2\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/12/14/4\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/12/15/3\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/cisagov/log4j-affected-db\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md\",\"source\":\"security@apache.org\",\"tags\":[\"Broken Link\",\"Product\",\"US Government Resource\"]},{\"url\":\"https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228\",\"source\":\"security@apache.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/\",\"source\":\"security@apache.org\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/\",\"source\":\"security@apache.org\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://logging.apache.org/log4j/2.x/security.html\",\"source\":\"security@apache.org\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/\",\"source\":\"security@apache.org\",\"tags\":[\"Patch\",\"Third Party Advisory\",\"Vendor Advisory\"]},{\"url\":\"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20211210-0007/\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.apple.com/kb/HT213189\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://twitter.com/kurtseifried/status/1469345530182455296\",\"source\":\"security@apache.org\",\"tags\":[\"Broken Link\",\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2021/dsa-5020\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.kb.cert.org/vuls/id/930724\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html\",\"source\":\"security@apache.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/alert-cve-2021-44228.html\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2022.html\",\"source\":\"security@apache.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2022.html\",\"source\":\"security@apache.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://seclists.org/fulldisclosure/2022/Dec/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2022/Jul/11\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2022/Mar/23\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/12/10/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/12/10/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/12/10/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/12/13/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/12/13/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/12/14/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/12/15/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/cisagov/log4j-affected-db\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Product\",\"US Government Resource\"]},{\"url\":\"https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://logging.apache.org/log4j/2.x/security.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\",\"Vendor Advisory\"]},{\"url\":\"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20211210-0007/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.apple.com/kb/HT213189\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://twitter.com/kurtseifried/status/1469345530182455296\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2021/dsa-5020\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.kb.cert.org/vuls/id/930724\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/alert-cve-2021-44228.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2022.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2022.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://logging.apache.org/log4j/2.x/security.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/10/1\", \"name\": \"[oss-security] 20211210 CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/10/2\", \"name\": \"[oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd\", \"name\": \"20211210 Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/10/3\", \"name\": \"[oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20211210-0007/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.oracle.com/security-alerts/alert-cve-2021-44228.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.debian.org/security/2021/dsa-5020\", \"name\": \"DSA-5020\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html\", \"name\": \"[debian-lts-announce] 20211212 [SECURITY] [DLA 2842-1] apache-log4j2 security update\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/\", \"name\": \"FEDORA-2021-f0f501d01f\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/\", \"name\": \"Microsoft\\u2019s Response to CVE-2021-44228 Apache Log4j 2\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/13/2\", \"name\": \"[oss-security] 20211213 Re: CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/13/1\", \"name\": \"[oss-security] 20211213 CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/14/4\", \"name\": \"[oss-security] 20211214 CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd\", \"name\": \"20211210 A Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://www.kb.cert.org/vuls/id/930724\", \"name\": \"VU#930724\", \"tags\": [\"third-party-advisory\", \"x_transferred\"]}, {\"url\": \"https://twitter.com/kurtseifried/status/1469345530182455296\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd\", \"name\": \"20211210 Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/15/3\", \"name\": \"[oss-security] 20211215 Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/\", \"name\": \"FEDORA-2021-66d6c484f3\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/Mar/23\", \"name\": \"20220314 APPLE-SA-2022-03-14-7 Xcode 13.3\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/cisagov/log4j-affected-db\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://support.apple.com/kb/HT213189\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/Jul/11\", \"name\": \"20220721 Open-Xchange Security Advisory 2022-07-21\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/Dec/2\", \"name\": \"20221208 Intel Data Center Manager \u003c= 5.1 Local Privileges Escalation\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T04:17:24.696Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 10, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-44228\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-04T14:25:34.416117Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2021-12-10\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228\"}}}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2021-12-10T00:00:00.000Z\", \"value\": \"CVE-2021-44228 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-04T14:24:34.308Z\"}}], \"cna\": {\"title\": \"Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"value\": \"This issue was discovered by Chen Zhaojun of Alibaba Cloud Security Team.\"}], \"metrics\": [{\"other\": {\"type\": \"unknown\", \"content\": {\"other\": \"critical\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Log4j2\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"2.3.1\", \"status\": \"unaffected\"}, {\"at\": \"2.4\", \"status\": \"affected\"}, {\"at\": \"2.12.2\", \"status\": \"unaffected\"}, {\"at\": \"2.13.0\", \"status\": \"affected\"}, {\"at\": \"2.15.0\", \"status\": \"unaffected\"}], \"version\": \"2.0-beta9\", \"lessThan\": \"log4j-core*\", \"versionType\": \"custom\"}]}], \"references\": [{\"url\": \"https://logging.apache.org/log4j/2.x/security.html\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/10/1\", \"name\": \"[oss-security] 20211210 CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints\", \"tags\": [\"mailing-list\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/10/2\", \"name\": \"[oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd\", \"name\": \"20211210 Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/10/3\", \"name\": \"[oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20211210-0007/\"}, {\"url\": \"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html\"}, {\"url\": \"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032\"}, {\"url\": \"https://www.oracle.com/security-alerts/alert-cve-2021-44228.html\"}, {\"url\": \"https://www.debian.org/security/2021/dsa-5020\", \"name\": \"DSA-5020\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html\", \"name\": \"[debian-lts-announce] 20211212 [SECURITY] [DLA 2842-1] apache-log4j2 security update\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/\", \"name\": \"FEDORA-2021-f0f501d01f\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/\", \"name\": \"Microsoft\\u2019s Response to CVE-2021-44228 Apache Log4j 2\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/13/2\", \"name\": \"[oss-security] 20211213 Re: CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2\", \"tags\": [\"mailing-list\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/13/1\", \"name\": \"[oss-security] 20211213 CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2\", \"tags\": [\"mailing-list\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/14/4\", \"name\": \"[oss-security] 20211214 CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd\", \"name\": \"20211210 A Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.kb.cert.org/vuls/id/930724\", \"name\": \"VU#930724\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://twitter.com/kurtseifried/status/1469345530182455296\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf\"}, {\"url\": \"http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html\"}, {\"url\": \"http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html\"}, {\"url\": \"http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html\"}, {\"url\": \"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html\"}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd\", \"name\": \"20211210 Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/12/15/3\", \"name\": \"[oss-security] 20211215 Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack\", \"tags\": [\"mailing-list\"]}, {\"url\": \"http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html\"}, {\"url\": \"http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html\"}, {\"url\": \"http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html\"}, {\"url\": \"http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html\"}, {\"url\": \"http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/\", \"name\": \"FEDORA-2021-66d6c484f3\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf\"}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\"}, {\"url\": \"http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html\"}, {\"url\": \"https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md\"}, {\"url\": \"http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html\"}, {\"url\": \"http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html\"}, {\"url\": \"http://seclists.org/fulldisclosure/2022/Mar/23\", \"name\": \"20220314 APPLE-SA-2022-03-14-7 Xcode 13.3\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001\"}, {\"url\": \"https://github.com/cisagov/log4j-affected-db\"}, {\"url\": \"https://support.apple.com/kb/HT213189\"}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\"}, {\"url\": \"https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228\"}, {\"url\": \"https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html\"}, {\"url\": \"http://seclists.org/fulldisclosure/2022/Jul/11\", \"name\": \"20220721 Open-Xchange Security Advisory 2022-07-21\", \"tags\": [\"mailing-list\"]}, {\"url\": \"http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html\"}, {\"url\": \"http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html\"}, {\"url\": \"http://seclists.org/fulldisclosure/2022/Dec/2\", \"name\": \"20221208 Intel Data Center Manager \u003c= 5.1 Local Privileges Escalation\", \"tags\": [\"mailing-list\"]}, {\"url\": \"http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"CWE-502 Deserialization of Untrusted Data\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400 Uncontrolled Resource Consumption\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2023-04-03T00:00:00.000Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2021-44228\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-21T23:25:23.121Z\", \"dateReserved\": \"2021-11-26T00:00:00.000Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2021-12-10T00:00:00.000Z\", \"assignerShortName\": \"apache\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
RHSA-2025:1746
Vulnerability from csaf_redhat - Published: 2025-02-24 00:08 - Updated: 2026-06-28 12:22A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A "gadget" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
A flaw was found in velocity. An attacker, able to modify Velocity templates, may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — |
A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. A remote attacker who can control log messages or log message parameters, can execute arbitrary code on the server via JNDI LDAP endpoint.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.16.0. A remote attacker with control over Thread Context Map (MDC) input data could craft malicious input using a JNDI Lookup pattern resulting in remote code execution (RCE) in a limited number of environments.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
A flaw was found in codec-haproxy from the Netty project. This flaw allows an attacker to build a malformed crafted message and cause infinite recursion, causing stack exhaustion and leading to a denial of service (DoS).
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code execution (RCE) and unintentional contact with untrusted remote servers.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch | — |
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.8, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.9 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS [eap-7.1.z] (CVE-2022-41881)\n\n* velocity: arbitrary code execution when attacker is able to modify templates [eap-7.1.z] (CVE-2020-13936)\n\n* jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution [eap-7.1.z] (CVE-2020-10673)\n\n* jackson-databind: Serialization gadgets in anteros-core [eap-7.1.z] (CVE-2020-9548)\n\n* jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution [eap-7.1.z] (CVE-2020-10672)\n\n* wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users [eap-7.1.z] (CVE-2021-3717)\n\n* jackson-databind: Serialization gadgets in ibatis-sqlmap [eap-7.1.z] (CVE-2020-9547)\n\n* log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) [eap-7.1.z] (CVE-2021-45046)\n\n* log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [eap-7.1.z] (CVE-2021-44228)\n\n* jackson-databind: Serialization gadgets in shaded-hikari-config [eap-7.1.z] (CVE-2020-9546)\n\n* CXF: Apache CXF: directory listing / code exfiltration [eap-7.1.z] (CVE-2022-46363)\n\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability [eap-7.1.z] (CVE-2022-45047)\n\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos [eap-7.1.z] (CVE-2022-45693)\n\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS [eap-7.1.z] (CVE-2022-42003)\n\n* jackson-databind: use of deeply nested arrays [eap-7.1.z] (CVE-2022-42004)\n\n* jackson-databind: Lacks certain xbean-reflect/JNDI blocking [eap-7.1.z] (CVE-2020-8840)\n\n* snakeyaml: Constructor Deserialization Remote Code Execution [eap-7.1.z] (CVE-2022-1471)\n\n* commons-text: apache-commons-text: variable interpolation RCE [eap-7.1.z] (CVE-2022-42889)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:1746",
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index"
},
{
"category": "external",
"summary": "1815470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1815470"
},
{
"category": "external",
"summary": "1815495",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1815495"
},
{
"category": "external",
"summary": "1816330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816330"
},
{
"category": "external",
"summary": "1816332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816332"
},
{
"category": "external",
"summary": "1816337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816337"
},
{
"category": "external",
"summary": "1816340",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816340"
},
{
"category": "external",
"summary": "1937440",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1937440"
},
{
"category": "external",
"summary": "1991305",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1991305"
},
{
"category": "external",
"summary": "2030932",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2030932"
},
{
"category": "external",
"summary": "2032580",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2032580"
},
{
"category": "external",
"summary": "2135244",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244"
},
{
"category": "external",
"summary": "2135247",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247"
},
{
"category": "external",
"summary": "2135435",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135435"
},
{
"category": "external",
"summary": "2145194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194"
},
{
"category": "external",
"summary": "2150009",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009"
},
{
"category": "external",
"summary": "2153379",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153379"
},
{
"category": "external",
"summary": "2155681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681"
},
{
"category": "external",
"summary": "2155970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970"
},
{
"category": "external",
"summary": "JBEAP-28583",
"url": "https://issues.redhat.com/browse/JBEAP-28583"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1746.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update",
"tracking": {
"current_release_date": "2026-06-28T12:22:57+00:00",
"generator": {
"date": "2026-06-28T12:22:57+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.2.6"
}
},
"id": "RHSA-2025:1746",
"initial_release_date": "2025-02-24T00:08:27+00:00",
"revision_history": [
{
"date": "2025-02-24T00:08:27+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-02-24T00:08:27+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-28T12:22:57+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product": {
"name": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Enterprise Application Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"product": {
"name": "eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"product_id": "eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty@4.1.63-1.Final_redhat_00002.1.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"product": {
"name": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"product_id": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-snakeyaml@1.33.0-1.SP1_redhat_00001.1.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"product": {
"name": "eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"product_id": "eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jettison@1.3.8-2.redhat_00002.1.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"product": {
"name": "eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"product_id": "eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-apache-cxf@3.1.16-4.redhat_00003.1.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"product": {
"name": "eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"product_id": "eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-databind@2.8.11.6-2.SP1_redhat_00002.1.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"product": {
"name": "eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"product_id": "eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-velocity@1.7.0-3.redhat_00006.1.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"product": {
"name": "eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"product_id": "eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly@7.1.9-2.GA_redhat_00002.1.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"product": {
"name": "eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"product_id": "eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"product": {
"name": "eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"product_id": "eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty@4.1.63-1.Final_redhat_00002.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"product": {
"name": "eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"product_id": "eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-all@4.1.63-1.Final_redhat_00002.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-snakeyaml@1.33.0-1.SP1_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"product": {
"name": "eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"product_id": "eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jettison@1.3.8-2.redhat_00002.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"product": {
"name": "eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"product_id": "eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-apache-cxf@3.1.16-4.redhat_00003.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"product": {
"name": "eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"product_id": "eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-apache-cxf-rt@3.1.16-4.redhat_00003.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"product": {
"name": "eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"product_id": "eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-apache-cxf-services@3.1.16-4.redhat_00003.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"product": {
"name": "eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"product_id": "eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-apache-cxf-tools@3.1.16-4.redhat_00003.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"product": {
"name": "eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"product_id": "eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-databind@2.8.11.6-2.SP1_redhat_00002.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"product": {
"name": "eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"product_id": "eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-velocity@1.7.0-3.redhat_00006.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"product": {
"name": "eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"product_id": "eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly@7.1.9-2.GA_redhat_00002.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"product": {
"name": "eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"product_id": "eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.1.9-2.GA_redhat_00002.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-atom-provider@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-cdi@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-client@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-crypto@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-jackson-provider@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-jackson2-provider@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-jaxb-provider@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-jaxrs@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-jettison-provider@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-jose-jwt@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-jsapi@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-json-p-provider@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-multipart-provider@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-spring@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-validator-provider-11@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product": {
"name": "eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_id": "eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-yaml-provider@3.0.27-1.Final_redhat_00001.1.ep7.el7?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch"
},
"product_reference": "eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src"
},
"product_reference": "eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch"
},
"product_reference": "eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch"
},
"product_reference": "eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch"
},
"product_reference": "eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch"
},
"product_reference": "eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src"
},
"product_reference": "eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch"
},
"product_reference": "eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src"
},
"product_reference": "eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch"
},
"product_reference": "eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src"
},
"product_reference": "eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch"
},
"product_reference": "eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src"
},
"product_reference": "eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch"
},
"product_reference": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src"
},
"product_reference": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch"
},
"product_reference": "eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src"
},
"product_reference": "eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
},
"product_reference": "eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src"
},
"product_reference": "eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
},
"product_reference": "eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-8840",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2020-03-02T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1816330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A \"gadget\" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Lacks certain xbean-reflect/JNDI blocking",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8840"
},
{
"category": "external",
"summary": "RHBZ#1816330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8840",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8840"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8840",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8840"
}
],
"release_date": "2020-03-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Lacks certain xbean-reflect/JNDI blocking"
},
{
"cve": "CVE-2020-9546",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2020-03-02T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1816332"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Serialization gadgets in shaded-hikari-config",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-9546"
},
{
"category": "external",
"summary": "RHBZ#1816332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-9546",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-9546"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9546",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9546"
}
],
"release_date": "2020-03-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Serialization gadgets in shaded-hikari-config"
},
{
"cve": "CVE-2020-9547",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2020-03-02T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1816337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Serialization gadgets in ibatis-sqlmap",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-9547"
},
{
"category": "external",
"summary": "RHBZ#1816337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-9547",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-9547"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9547",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9547"
}
],
"release_date": "2020-03-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Serialization gadgets in ibatis-sqlmap"
},
{
"cve": "CVE-2020-9548",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2020-03-02T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1816340"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Serialization gadgets in anteros-core",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-9548"
},
{
"category": "external",
"summary": "RHBZ#1816340",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816340"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-9548",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-9548"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9548",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9548"
}
],
"release_date": "2020-03-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Serialization gadgets in anteros-core"
},
{
"cve": "CVE-2020-10672",
"cwe": {
"id": "CWE-96",
"name": "Improper Neutralization of Directives in Statically Saved Code (\u0027Static Code Injection\u0027)"
},
"discovery_date": "2020-03-19T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1815495"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10672"
},
{
"category": "external",
"summary": "RHBZ#1815495",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1815495"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10672",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10672"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10672",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10672"
}
],
"release_date": "2020-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution"
},
{
"cve": "CVE-2020-10673",
"cwe": {
"id": "CWE-96",
"name": "Improper Neutralization of Directives in Statically Saved Code (\u0027Static Code Injection\u0027)"
},
"discovery_date": "2020-03-19T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1815470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time. Additionally, the gadget is not available within Red Hat Openstack Platform\u0027s OpenDaylight.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10673"
},
{
"category": "external",
"summary": "RHBZ#1815470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1815470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10673",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10673"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10673",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10673"
}
],
"release_date": "2020-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution"
},
{
"cve": "CVE-2020-13936",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2021-03-10T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1937440"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in velocity. An attacker, able to modify Velocity templates, may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "velocity: arbitrary code execution when attacker is able to modify templates",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift Container Platform (OCP) openshift-logging/elasticsearch6-rhel8 container does contain a vulnerable version of velocity. The references to the library only occur in the x-pack component which is an enterprise-only feature of Elasticsearch - hence it has been marked as wontfix as this time and may be fixed in a future release. Additionally the hive container only references velocity in the testutils of the code but the code still exists in the container, as such it has been given a Moderate impact.\n\n* Velocity as shipped with Red Hat Enterprise Linux 6 is not affected because it does not contain the vulnerable code.\n\n* Velocity as shipped with Red Hat Enterprise Linux 7 contains a vulnerable version, but it is used as a dependency for IdM/ipa, which does not use the vulnerable functionality. It has been marked as Moderate for this reason.\n\n* Although velocity shipped in Red Hat Enterprise Linux 8\u0027s pki-deps:10.6 for IdM/ipa is a vulnerable version, the vulnerable code is not used by pki. It has been marked as Low for this reason.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src"
],
"known_not_affected": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-13936"
},
{
"category": "external",
"summary": "RHBZ#1937440",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1937440"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-13936",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13936"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-13936",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13936"
}
],
"release_date": "2021-03-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "velocity: arbitrary code execution when attacker is able to modify templates"
},
{
"cve": "CVE-2021-3717",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"discovery_date": "2021-07-27T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1991305"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-3717"
},
{
"category": "external",
"summary": "RHBZ#1991305",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1991305"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-3717",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3717"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3717",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3717"
}
],
"release_date": "2021-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users"
},
{
"cve": "CVE-2021-44228",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2021-12-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2030932"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. A remote attacker who can control log messages or log message parameters, can execute arbitrary code on the server via JNDI LDAP endpoint.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue only affects log4j versions between 2.0 and 2.14.1. In order to exploit this flaw you need:\n- A remotely accessible endpoint with any protocol (HTTP, TCP, etc) that allows an attacker to send arbitrary data,\n- A log statement in the endpoint that logs the attacker controlled data.\n\nIn Red Hat OpenShift Logging the vulnerable log4j library is shipped in the Elasticsearch components. Because Elasticsearch is not susceptible to remote code execution with this vulnerability due to use of the Java Security Manager and because access to these components is limited, the impact by this vulnerability is reduced to Moderate.\n\nAs per upstream applications using Log4j 1.x may be impacted by this flaw if their configuration uses JNDI. However, the risk is much lower. This flaw in Log4j 1.x is tracked via https://access.redhat.com/security/cve/CVE-2021-4104 and has been rated as having Moderate security impact.\n\nCodeReady Studio version 12.21.1 was released containing a fix for this vulnerability.\n\nThe following products are NOT affected by this flaw and have been explicitly listed here for the benefit of our customers.\n- Red Hat Enterprise Linux\n- Red Hat Advanced Cluster Management for Kubernetes \n- Red Hat Advanced Cluster Security for Kubernetes\n- Red Hat Ansible Automation Platform (Engine and Tower)\n- Red Hat Certificate System\n- Red Hat Directory Server\n- Red Hat Identity Management\n- Red Hat CloudForms \n- Red Hat Update Infrastructure\n- Red Hat Satellite\n- Red Hat Ceph Storage\n- Red Hat Gluster Storage\n- Red Hat OpenShift Data Foundation\n- Red Hat OpenStack Platform\n- Red Hat Virtualization\n- Red Hat Single Sign-On\n- Red Hat 3scale API Management",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-44228"
},
{
"category": "external",
"summary": "RHBZ#2030932",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2030932"
},
{
"category": "external",
"summary": "RHSB-2021-009",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2021-009"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-44228",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44228"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q",
"url": "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q"
},
{
"category": "external",
"summary": "https://logging.apache.org/log4j/2.x/security.html",
"url": "https://logging.apache.org/log4j/2.x/security.html"
},
{
"category": "external",
"summary": "https://www.lunasec.io/docs/blog/log4j-zero-day/",
"url": "https://www.lunasec.io/docs/blog/log4j-zero-day/"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2021-12-10T02:01:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
},
{
"category": "workaround",
"details": "For Log4j versions \u003e=2.10\nset the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true\n\nFor Log4j versions \u003e=2.7 and \u003c=2.14.1\nall PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m\n\nFor Log4j versions \u003e=2.0-beta9 and \u003c=2.10.0\nremove the JndiLookup class from the classpath. For example: \n```\nzip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class\n```\n\nOn OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421\n\nOn OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2021-12-10T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Critical"
}
],
"title": "log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value"
},
{
"cve": "CVE-2021-45046",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2021-12-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2032580"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.16.0. A remote attacker with control over Thread Context Map (MDC) input data could craft malicious input using a JNDI Lookup pattern resulting in remote code execution (RCE) in a limited number of environments.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Although we have matched Apache\u0027s CVSS score, with the exception of the scope metric which will remain unaltered at \"unchanged\"; as we believe code execution would be at the permission levels of the running JVM and not exceeding that of the original CVE-2021-44228 flaw.\n \nWe have given this vulnerability an impact rating of Moderate, this is because of the unlikely nature of log4j lookup mapping values being derived from attacker controlled values. This is not the default configuration for end-applications using log4j 2.x and would require explicit action from a privileged user (a developer or administrator) to access the vulnerability. \nIn certain non-default configurations, it was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was insufficient.\n\nThis issue affects the log4j version between 2.0 and 2.15. Log4j 1.x is NOT impacted by this vulnerability. \n\nPrerequisites to exploit this flaw are :\n\n- A remotely accessible endpoint with any protocol (HTTP, TCP, etc) that allows an attacker to send arbitrary data,\n- A log statement in the endpoint that logs the attacker controlled data.\n- Log4j configuration file should be explicitly configured to use a non-default Pattern Layout with a Context Lookup eg. ($${ctx:loginId}) \n\nIn most cases, the mitigation suggested for CVE-2021-44228 (i.e. to set the system property `log4j2.noFormatMsgLookup` to `true) does NOT mitigate this specific vulnerability. \nLog4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.\n\nFor Elasticsearch, as shipped in OpenShift 3.11, the \"log4j2.formatMsgNoLookups=true\" system property mitigation is sufficient as there are no included non-standard configurations that allow for exploitation:\n\nhttps://github.com/openshift/openshift-ansible/blob/release-3.11/roles/openshift_logging_elasticsearch/templates/log4j2.properties.j2\n\nhttps://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476\n\nFor CodeReady Studio the fix for this flaw is available on CodeReady Studio 12.21.3 and above versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-45046"
},
{
"category": "external",
"summary": "RHBZ#2032580",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2032580"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-45046",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45046"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2021-44228",
"url": "https://access.redhat.com/security/cve/CVE-2021-44228"
},
{
"category": "external",
"summary": "https://logging.apache.org/log4j/2.x/security.html",
"url": "https://logging.apache.org/log4j/2.x/security.html"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2021/12/14/4",
"url": "https://www.openwall.com/lists/oss-security/2021/12/14/4"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2021-12-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
},
{
"category": "workaround",
"details": "For Log4j versions up to and including 2.15.0, this issue can be mitigated by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2023-05-01T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Moderate"
}
],
"title": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)"
},
{
"cve": "CVE-2022-1471",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2022-12-01T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2150009"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "SnakeYaml: Constructor Deserialization Remote Code Execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src"
],
"known_not_affected": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-1471"
},
{
"category": "external",
"summary": "RHBZ#2150009",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1471"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471"
},
{
"category": "external",
"summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2",
"url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2"
}
],
"release_date": "2022-10-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "SnakeYaml: Constructor Deserialization Remote Code Execution"
},
{
"cve": "CVE-2022-41881",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2022-12-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2153379"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in codec-haproxy from the Netty project. This flaw allows an attacker to build a malformed crafted message and cause infinite recursion, causing stack exhaustion and leading to a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-41881"
},
{
"category": "external",
"summary": "RHBZ#2153379",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153379"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-41881",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41881"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41881",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41881"
}
],
"release_date": "2022-12-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS"
},
{
"cve": "CVE-2022-42003",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2022-10-17T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2135244"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-42003"
},
{
"category": "external",
"summary": "RHBZ#2135244",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42003"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003"
}
],
"release_date": "2022-10-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS"
},
{
"cve": "CVE-2022-42004",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2022-10-17T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2135247"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: use of deeply nested arrays",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-42004"
},
{
"category": "external",
"summary": "RHBZ#2135247",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42004"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004"
}
],
"release_date": "2022-10-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jackson-databind: use of deeply nested arrays"
},
{
"cve": "CVE-2022-42889",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2022-10-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2135435"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code execution (RCE) and unintentional contact with untrusted remote servers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-commons-text: variable interpolation RCE",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In order to carry successful exploitation of this vulnerability, the following conditions must be in place on the affected target:\n - Usage of specific methods that interpolate the variables as described in the flaw\n - Usage of external input for those methods\n - Usage of that external input has to be unsanitized/no \"allow list\"/etc.\n\nThe following products have *Low* impact because they have maven references to the affected package but do not ship it nor use the code:\n- Red Hat EAP Expansion Pack (EAP-XP)\n- Red Hat Camel-K\n- Red Hat Camel-Quarkus\n\nRed Hat Satellite ships Candlepin that embeds Apache Commons Text, however, it is not vulnerable to the flaw since the library has not been exposed in the product code. In Candlepin, the Commons Text is being pulled for the Liquibase and ActiveMQ Artemis libraries as a dependency. Red Hat Product Security has evaluated and rated the impact of the flaw as Low for Satellite since there was no harm identified to the confidentiality, integrity, or availability of systems.\n\n- The OCP has a *Moderate* impact because the affected library is a third-party library in the OCP jenkins-2-plugin component which reduces the possibilities of successful exploitation.\n- The OCP-4.8 is affected by this CVE and is in an extended life phase. For versions of products in the Extended Life Phase, Red Hat will provide limited ongoing technical support. No bug fixes, security fixes, hardware enablement or root-cause analysis will be available during this phase, and support will be provided on existing installations only.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-42889"
},
{
"category": "external",
"summary": "RHBZ#2135435",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135435"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-42889",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42889"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42889",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42889"
},
{
"category": "external",
"summary": "https://blogs.apache.org/security/entry/cve-2022-42889",
"url": "https://blogs.apache.org/security/entry/cve-2022-42889"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om",
"url": "https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om"
},
{
"category": "external",
"summary": "https://seclists.org/oss-sec/2022/q4/22",
"url": "https://seclists.org/oss-sec/2022/q4/22"
}
],
"release_date": "2022-10-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
},
{
"category": "workaround",
"details": "This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations.",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "apache-commons-text: variable interpolation RCE"
},
{
"cve": "CVE-2022-45047",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2022-11-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2145194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina-sshd: Java unsafe deserialization vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45047"
},
{
"category": "external",
"summary": "RHBZ#2145194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45047"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047"
},
{
"category": "external",
"summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html",
"url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html"
}
],
"release_date": "2022-11-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
},
{
"category": "workaround",
"details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mina-sshd: Java unsafe deserialization vulnerability"
},
{
"cve": "CVE-2022-45693",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2022-12-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2155970"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45693"
},
{
"category": "external",
"summary": "RHBZ#2155970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45693"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693"
}
],
"release_date": "2022-12-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos"
},
{
"cve": "CVE-2022-46363",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2022-12-21T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2155681"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: directory listing / code exfiltration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-46363"
},
{
"category": "external",
"summary": "RHBZ#2155681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-46363",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-46363"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c",
"url": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c"
}
],
"release_date": "2022-12-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:27+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-rt-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-services-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-apache-cxf-tools-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-atom-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-cdi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-client-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-crypto-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxb-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jaxrs-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jettison-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jose-jwt-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-jsapi-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-json-p-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-multipart-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-spring-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-resteasy-yaml-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.src",
"7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.9-2.GA_redhat_00002.1.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CXF: directory listing / code exfiltration"
}
]
}
RHSA-2025:1747
Vulnerability from csaf_redhat - Published: 2025-02-24 00:08 - Updated: 2026-07-01 19:33A flaw was found in velocity. An attacker, able to modify Velocity templates, may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
A flaw was found in h2. The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. This flaw allows an attacker to use this URL to send another server’s code, causing remote code execution. This issue is exploited through various attack vectors, most notably through the H2 Console, which leads to unauthenticated remote code execution.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. A remote attacker who can control log messages or log message parameters, can execute arbitrary code on the server via JNDI LDAP endpoint.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
An Uncontrolled Resource Consumption flaw was found in minimist. The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. This flaw (CVE-2021-44906) allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.
CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.16.0. A remote attacker with control over Thread Context Map (MDC) input data could craft malicious input using a JNDI Lookup pattern resulting in remote code execution (RCE) in a limited number of environments.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
A flaw was found in codec-haproxy from the Netty project. This flaw allows an attacker to build a malformed crafted message and cause infinite recursion, causing stack exhaustion and leading to a denial of service (DoS).
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code execution (RCE) and unintentional contact with untrusted remote servers.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch | — |
Vendor Fix
fix
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat\nJBoss Enterprise Application Platform 7.3.12 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.3.11, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.12 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* velocity: arbitrary code execution when attacker is able to modify templates [eap-7.3.z] (CVE-2020-13936)\n\n* CXF: Apache CXF: directory listing / code exfiltration [eap-7.3.z] (CVE-2022-46363)\n\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability [eap-7.3.z] (CVE-2022-45047)\n\n* log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [eap-7.3.z] (CVE-2021-44228)\n\n* commons-text: apache-commons-text: variable interpolation RCE [eap-7.3.z] (CVE-2022-42889)\n\n* log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) [eap-7.3.z] (CVE-2021-45046)\n\n* org.jboss.hal-hal-parent: minimist: prototype pollution [eap-7.3.z] (CVE-2021-44906)\n\n* jackson-databind: use of deeply nested arrays [eap-7.3.z] (CVE-2022-42004)\n\n* snakeyaml: Constructor Deserialization Remote Code Execution [eap-7.3.z] (CVE-2022-1471)\n\n* codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS [eap-7.3.z] (CVE-2022-41881)\n\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS [eap-7.3.z] (CVE-2022-42003)\n\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos [eap-7.3.z] (CVE-2022-45693)\n\n* h2: Remote Code Execution in Console [eap-7.3.z] (CVE-2021-42392)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:1747",
"url": "https://access.redhat.com/errata/RHSA-2025:1747"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/vulnerabilities/RHSB-2021-009",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2021-009"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index"
},
{
"category": "external",
"summary": "1937440",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1937440"
},
{
"category": "external",
"summary": "2030932",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2030932"
},
{
"category": "external",
"summary": "2032580",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2032580"
},
{
"category": "external",
"summary": "2039403",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2039403"
},
{
"category": "external",
"summary": "2066009",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009"
},
{
"category": "external",
"summary": "2135244",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244"
},
{
"category": "external",
"summary": "2135247",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247"
},
{
"category": "external",
"summary": "2135435",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135435"
},
{
"category": "external",
"summary": "2145194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194"
},
{
"category": "external",
"summary": "2150009",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009"
},
{
"category": "external",
"summary": "2153379",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153379"
},
{
"category": "external",
"summary": "2155681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681"
},
{
"category": "external",
"summary": "2155970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970"
},
{
"category": "external",
"summary": "JBEAP-28581",
"url": "https://issues.redhat.com/browse/JBEAP-28581"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1747.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.12 security update",
"tracking": {
"current_release_date": "2026-07-01T19:33:57+00:00",
"generator": {
"date": "2026-07-01T19:33:57+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2025:1747",
"initial_release_date": "2025-02-24T00:08:38+00:00",
"revision_history": [
{
"date": "2025-02-24T00:08:38+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-02-24T00:08:38+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-01T19:33:57+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product": {
"name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Enterprise Application Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"product": {
"name": "eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"product_id": "eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-hal-console@3.2.17-1.Final_redhat_00001.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"product": {
"name": "eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"product_id": "eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-databind@2.10.4-4.redhat_00004.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"product": {
"name": "eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"product_id": "eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty@4.1.63-4.Final_redhat_00002.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"product": {
"name": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"product_id": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-snakeyaml@1.33.0-1.SP1_redhat_00001.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"product": {
"name": "eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"product_id": "eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jettison@1.5.2-2.redhat_00002.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"product": {
"name": "eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"product_id": "eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-modules-base@2.10.4-4.redhat_00004.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"product": {
"name": "eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"product_id": "eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-annotations@2.10.4-2.redhat_00004.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"product": {
"name": "eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"product_id": "eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-core@2.10.4-2.redhat_00004.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"product": {
"name": "eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"product_id": "eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-jaxrs-providers@2.10.4-2.redhat_00004.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"product": {
"name": "eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"product_id": "eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-modules-java8@2.10.4-2.redhat_00004.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"product": {
"name": "eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"product_id": "eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly@7.3.12-3.GA_redhat_00002.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"product": {
"name": "eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"product_id": "eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy@3.11.6-1.Final_redhat_00001.1.el7eap?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-hal-console@3.2.17-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"product_id": "eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-databind@2.10.4-4.redhat_00004.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"product": {
"name": "eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"product_id": "eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty@4.1.63-4.Final_redhat_00002.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"product": {
"name": "eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"product_id": "eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-all@4.1.63-4.Final_redhat_00002.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-snakeyaml@1.33.0-1.SP1_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"product": {
"name": "eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"product_id": "eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jettison@1.5.2-2.redhat_00002.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"product_id": "eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-module-jaxb-annotations@2.10.4-4.redhat_00004.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"product_id": "eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-modules-base@2.10.4-4.redhat_00004.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product_id": "eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-annotations@2.10.4-2.redhat_00004.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product_id": "eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-core@2.10.4-2.redhat_00004.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product_id": "eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-jaxrs-base@2.10.4-2.redhat_00004.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product_id": "eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-jaxrs-json-provider@2.10.4-2.redhat_00004.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product_id": "eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-datatype-jdk8@2.10.4-2.redhat_00004.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product_id": "eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-datatype-jsr310@2.10.4-2.redhat_00004.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product_id": "eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-modules-java8@2.10.4-2.redhat_00004.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"product": {
"name": "eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"product_id": "eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly@7.3.12-3.GA_redhat_00002.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"product": {
"name": "eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"product_id": "eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk11@7.3.12-3.GA_redhat_00002.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"product": {
"name": "eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"product_id": "eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk8@7.3.12-3.GA_redhat_00002.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"product": {
"name": "eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"product_id": "eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly-javadocs@7.3.12-3.GA_redhat_00002.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"product": {
"name": "eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"product_id": "eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.3.12-3.GA_redhat_00002.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-atom-provider@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-cdi@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-client@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-client-microprofile@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-crypto@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-jackson-provider@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-jackson2-provider@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-jaxb-provider@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-jaxrs@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-jettison-provider@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-jose-jwt@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-jsapi@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-json-binding-provider@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-json-p-provider@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-multipart-provider@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-rxjava2@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-spring@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-validator-provider-11@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-resteasy-yaml-provider@3.11.6-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src"
},
"product_reference": "eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src"
},
"product_reference": "eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src"
},
"product_reference": "eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src"
},
"product_reference": "eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src"
},
"product_reference": "eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src"
},
"product_reference": "eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src"
},
"product_reference": "eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch"
},
"product_reference": "eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src"
},
"product_reference": "eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch"
},
"product_reference": "eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src"
},
"product_reference": "eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch"
},
"product_reference": "eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src"
},
"product_reference": "eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src"
},
"product_reference": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
},
"product_reference": "eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src"
},
"product_reference": "eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
},
"product_reference": "eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
},
"product_reference": "eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
},
"product_reference": "eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
},
"product_reference": "eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-13936",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2021-03-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1937440"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in velocity. An attacker, able to modify Velocity templates, may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "velocity: arbitrary code execution when attacker is able to modify templates",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift Container Platform (OCP) openshift-logging/elasticsearch6-rhel8 container does contain a vulnerable version of velocity. The references to the library only occur in the x-pack component which is an enterprise-only feature of Elasticsearch - hence it has been marked as wontfix as this time and may be fixed in a future release. Additionally the hive container only references velocity in the testutils of the code but the code still exists in the container, as such it has been given a Moderate impact.\n\n* Velocity as shipped with Red Hat Enterprise Linux 6 is not affected because it does not contain the vulnerable code.\n\n* Velocity as shipped with Red Hat Enterprise Linux 7 contains a vulnerable version, but it is used as a dependency for IdM/ipa, which does not use the vulnerable functionality. It has been marked as Moderate for this reason.\n\n* Although velocity shipped in Red Hat Enterprise Linux 8\u0027s pki-deps:10.6 for IdM/ipa is a vulnerable version, the vulnerable code is not used by pki. It has been marked as Low for this reason.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-13936"
},
{
"category": "external",
"summary": "RHBZ#1937440",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1937440"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-13936",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13936"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-13936",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13936"
}
],
"release_date": "2021-03-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:38+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "velocity: arbitrary code execution when attacker is able to modify templates"
},
{
"cve": "CVE-2021-42392",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2022-01-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2039403"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in h2. The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. This flaw allows an attacker to use this URL to send another server\u2019s code, causing remote code execution. This issue is exploited through various attack vectors, most notably through the H2 Console, which leads to unauthenticated remote code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "h2: Remote Code Execution in Console",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In OpenShift Container Platform (OCP) the openshift4/ose-metering-presto container image ships the vulnerable version of h2, but as it uses default configuration the impact by this vulnerability is LOW. Additionally, the Presto component is part of the OCP Metering stack and since the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected component is marked as wontfix.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-42392"
},
{
"category": "external",
"summary": "RHBZ#2039403",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2039403"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-42392",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42392"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-42392",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42392"
},
{
"category": "external",
"summary": "https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6",
"url": "https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6"
}
],
"release_date": "2022-01-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:38+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "h2: Remote Code Execution in Console"
},
{
"cve": "CVE-2021-44228",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2021-12-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2030932"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. A remote attacker who can control log messages or log message parameters, can execute arbitrary code on the server via JNDI LDAP endpoint.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue only affects log4j versions between 2.0 and 2.14.1. In order to exploit this flaw you need:\n- A remotely accessible endpoint with any protocol (HTTP, TCP, etc) that allows an attacker to send arbitrary data,\n- A log statement in the endpoint that logs the attacker controlled data.\n\nIn Red Hat OpenShift Logging the vulnerable log4j library is shipped in the Elasticsearch components. Because Elasticsearch is not susceptible to remote code execution with this vulnerability due to use of the Java Security Manager and because access to these components is limited, the impact by this vulnerability is reduced to Moderate.\n\nAs per upstream applications using Log4j 1.x may be impacted by this flaw if their configuration uses JNDI. However, the risk is much lower. This flaw in Log4j 1.x is tracked via https://access.redhat.com/security/cve/CVE-2021-4104 and has been rated as having Moderate security impact.\n\nCodeReady Studio version 12.21.1 was released containing a fix for this vulnerability.\n\nThe following products are NOT affected by this flaw and have been explicitly listed here for the benefit of our customers.\n- Red Hat Enterprise Linux\n- Red Hat Advanced Cluster Management for Kubernetes \n- Red Hat Advanced Cluster Security for Kubernetes\n- Red Hat Ansible Automation Platform (Engine and Tower)\n- Red Hat Certificate System\n- Red Hat Directory Server\n- Red Hat Identity Management\n- Red Hat CloudForms \n- Red Hat Update Infrastructure\n- Red Hat Satellite\n- Red Hat Ceph Storage\n- Red Hat Gluster Storage\n- Red Hat OpenShift Data Foundation\n- Red Hat OpenStack Platform\n- Red Hat Virtualization\n- Red Hat Single Sign-On\n- Red Hat 3scale API Management",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-44228"
},
{
"category": "external",
"summary": "RHBZ#2030932",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2030932"
},
{
"category": "external",
"summary": "RHSB-2021-009",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2021-009"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-44228",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44228"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q",
"url": "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q"
},
{
"category": "external",
"summary": "https://logging.apache.org/log4j/2.x/security.html",
"url": "https://logging.apache.org/log4j/2.x/security.html"
},
{
"category": "external",
"summary": "https://www.lunasec.io/docs/blog/log4j-zero-day/",
"url": "https://www.lunasec.io/docs/blog/log4j-zero-day/"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2021-12-10T02:01:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:38+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1747"
},
{
"category": "workaround",
"details": "For Log4j versions \u003e=2.10\nset the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true\n\nFor Log4j versions \u003e=2.7 and \u003c=2.14.1\nall PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m\n\nFor Log4j versions \u003e=2.0-beta9 and \u003c=2.10.0\nremove the JndiLookup class from the classpath. For example: \n```\nzip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class\n```\n\nOn OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421\n\nOn OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2021-12-10T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Critical"
}
],
"title": "log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value"
},
{
"cve": "CVE-2021-44906",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"discovery_date": "2022-03-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2066009"
}
],
"notes": [
{
"category": "description",
"text": "An Uncontrolled Resource Consumption flaw was found in minimist. The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. This flaw (CVE-2021-44906) allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "minimist: prototype pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "As minimist is an argument parsing module for nodejs, exploitation of this vulnerability requires an attacker to influence which arguments are passed to nodejs when running a script. Red Hat products and services are designed in such a way that gaining this ability is not trivial. Additionally, the impact is limited by only enabling the pollution of functions, and not all generic objects.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-44906"
},
{
"category": "external",
"summary": "RHBZ#2066009",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44906"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h",
"url": "https://github.com/advisories/GHSA-xvch-5gv4-984h"
}
],
"release_date": "2022-03-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:38+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "minimist: prototype pollution"
},
{
"cve": "CVE-2021-45046",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2021-12-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2032580"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.16.0. A remote attacker with control over Thread Context Map (MDC) input data could craft malicious input using a JNDI Lookup pattern resulting in remote code execution (RCE) in a limited number of environments.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Although we have matched Apache\u0027s CVSS score, with the exception of the scope metric which will remain unaltered at \"unchanged\"; as we believe code execution would be at the permission levels of the running JVM and not exceeding that of the original CVE-2021-44228 flaw.\n \nWe have given this vulnerability an impact rating of Moderate, this is because of the unlikely nature of log4j lookup mapping values being derived from attacker controlled values. This is not the default configuration for end-applications using log4j 2.x and would require explicit action from a privileged user (a developer or administrator) to access the vulnerability. \nIn certain non-default configurations, it was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was insufficient.\n\nThis issue affects the log4j version between 2.0 and 2.15. Log4j 1.x is NOT impacted by this vulnerability. \n\nPrerequisites to exploit this flaw are :\n\n- A remotely accessible endpoint with any protocol (HTTP, TCP, etc) that allows an attacker to send arbitrary data,\n- A log statement in the endpoint that logs the attacker controlled data.\n- Log4j configuration file should be explicitly configured to use a non-default Pattern Layout with a Context Lookup eg. ($${ctx:loginId}) \n\nIn most cases, the mitigation suggested for CVE-2021-44228 (i.e. to set the system property `log4j2.noFormatMsgLookup` to `true) does NOT mitigate this specific vulnerability. \nLog4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.\n\nFor Elasticsearch, as shipped in OpenShift 3.11, the \"log4j2.formatMsgNoLookups=true\" system property mitigation is sufficient as there are no included non-standard configurations that allow for exploitation:\n\nhttps://github.com/openshift/openshift-ansible/blob/release-3.11/roles/openshift_logging_elasticsearch/templates/log4j2.properties.j2\n\nhttps://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476\n\nFor CodeReady Studio the fix for this flaw is available on CodeReady Studio 12.21.3 and above versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-45046"
},
{
"category": "external",
"summary": "RHBZ#2032580",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2032580"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-45046",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45046"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2021-44228",
"url": "https://access.redhat.com/security/cve/CVE-2021-44228"
},
{
"category": "external",
"summary": "https://logging.apache.org/log4j/2.x/security.html",
"url": "https://logging.apache.org/log4j/2.x/security.html"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2021/12/14/4",
"url": "https://www.openwall.com/lists/oss-security/2021/12/14/4"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2021-12-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:38+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1747"
},
{
"category": "workaround",
"details": "For Log4j versions up to and including 2.15.0, this issue can be mitigated by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2023-05-01T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Moderate"
}
],
"title": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)"
},
{
"cve": "CVE-2022-1471",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2022-12-01T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2150009"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "SnakeYaml: Constructor Deserialization Remote Code Execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src"
],
"known_not_affected": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-1471"
},
{
"category": "external",
"summary": "RHBZ#2150009",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1471"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471"
},
{
"category": "external",
"summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2",
"url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2"
}
],
"release_date": "2022-10-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:38+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "SnakeYaml: Constructor Deserialization Remote Code Execution"
},
{
"cve": "CVE-2022-41881",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2022-12-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2153379"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in codec-haproxy from the Netty project. This flaw allows an attacker to build a malformed crafted message and cause infinite recursion, causing stack exhaustion and leading to a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-41881"
},
{
"category": "external",
"summary": "RHBZ#2153379",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153379"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-41881",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41881"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41881",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41881"
}
],
"release_date": "2022-12-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:38+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS"
},
{
"cve": "CVE-2022-42003",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2022-10-17T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2135244"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-42003"
},
{
"category": "external",
"summary": "RHBZ#2135244",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42003"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003"
}
],
"release_date": "2022-10-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:38+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS"
},
{
"cve": "CVE-2022-42004",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2022-10-17T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2135247"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: use of deeply nested arrays",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-42004"
},
{
"category": "external",
"summary": "RHBZ#2135247",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42004"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004"
}
],
"release_date": "2022-10-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:38+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jackson-databind: use of deeply nested arrays"
},
{
"cve": "CVE-2022-42889",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2022-10-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2135435"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code execution (RCE) and unintentional contact with untrusted remote servers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-commons-text: variable interpolation RCE",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In order to carry successful exploitation of this vulnerability, the following conditions must be in place on the affected target:\n - Usage of specific methods that interpolate the variables as described in the flaw\n - Usage of external input for those methods\n - Usage of that external input has to be unsanitized/no \"allow list\"/etc.\n\nThe following products have *Low* impact because they have maven references to the affected package but do not ship it nor use the code:\n- Red Hat EAP Expansion Pack (EAP-XP)\n- Red Hat Camel-K\n- Red Hat Camel-Quarkus\n\nRed Hat Satellite ships Candlepin that embeds Apache Commons Text, however, it is not vulnerable to the flaw since the library has not been exposed in the product code. In Candlepin, the Commons Text is being pulled for the Liquibase and ActiveMQ Artemis libraries as a dependency. Red Hat Product Security has evaluated and rated the impact of the flaw as Low for Satellite since there was no harm identified to the confidentiality, integrity, or availability of systems.\n\n- The OCP has a *Moderate* impact because the affected library is a third-party library in the OCP jenkins-2-plugin component which reduces the possibilities of successful exploitation.\n- The OCP-4.8 is affected by this CVE and is in an extended life phase. For versions of products in the Extended Life Phase, Red Hat will provide limited ongoing technical support. No bug fixes, security fixes, hardware enablement or root-cause analysis will be available during this phase, and support will be provided on existing installations only.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-42889"
},
{
"category": "external",
"summary": "RHBZ#2135435",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135435"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-42889",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42889"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42889",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42889"
},
{
"category": "external",
"summary": "https://blogs.apache.org/security/entry/cve-2022-42889",
"url": "https://blogs.apache.org/security/entry/cve-2022-42889"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om",
"url": "https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om"
},
{
"category": "external",
"summary": "https://seclists.org/oss-sec/2022/q4/22",
"url": "https://seclists.org/oss-sec/2022/q4/22"
}
],
"release_date": "2022-10-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:38+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1747"
},
{
"category": "workaround",
"details": "This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations.",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "apache-commons-text: variable interpolation RCE"
},
{
"cve": "CVE-2022-45047",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2022-11-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2145194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina-sshd: Java unsafe deserialization vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45047"
},
{
"category": "external",
"summary": "RHBZ#2145194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45047"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047"
},
{
"category": "external",
"summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html",
"url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html"
}
],
"release_date": "2022-11-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:38+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1747"
},
{
"category": "workaround",
"details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mina-sshd: Java unsafe deserialization vulnerability"
},
{
"cve": "CVE-2022-45693",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2022-12-23T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2155970"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45693"
},
{
"category": "external",
"summary": "RHBZ#2155970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45693"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693"
}
],
"release_date": "2022-12-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:38+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos"
},
{
"cve": "CVE-2022-46363",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2022-12-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2155681"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: directory listing / code exfiltration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-46363"
},
{
"category": "external",
"summary": "RHBZ#2155681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-46363",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-46363"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c",
"url": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c"
}
],
"release_date": "2022-12-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T00:08:38+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-json-provider-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-module-jaxb-annotations-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-atom-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-cdi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-crypto-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jackson2-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxb-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jaxrs-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jettison-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jose-jwt-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-jsapi-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-json-p-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-multipart-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-rxjava2-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-spring-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-validator-provider-11-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-resteasy-yaml-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.12-3.GA_redhat_00002.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CXF: directory listing / code exfiltration"
}
]
}
SCA-2021-0003
Vulnerability from csaf_sick - Published: 2021-12-14 17:00 - Updated: 2021-12-17 12:00| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
SICK FieldEcho <1.5.3
SICK AG / FieldEcho
|
1612993
|
<1.5.3 |
Vendor Fix
|
|
SICK Function Block Factory <1.4.1
SICK AG / Function Block Factory
|
<1.4.1 |
Vendor Fix
|
|
|
SICK AppManager <1.5.0
SICK AG / AppManager
|
<1.5.0 |
Vendor Fix
|
|
|
SICK FieldEcho Dashboard <1.2.2
SICK AG / FieldEcho Dashboard
|
<1.2.2 |
Vendor Fix
|
|
|
SICK AppStudio <3.6.0
SICK AG / AppStudio
|
1610199
|
<3.6.0 |
Vendor Fix
|
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.",
"title": "General Security Measures"
},
{
"category": "general",
"text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer\u2019s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
"title": "Vulnerability Classification"
}
],
"publisher": {
"category": "vendor",
"contact_details": "psirt@sick.de",
"issuing_authority": "SICK PSIRT is responsible for any vulnerabilities related to SICK products.",
"name": "SICK PSIRT",
"namespace": "https://www.sick.com/psirt"
},
"references": [
{
"summary": "SICK PSIRT Security Advisories",
"url": "https://sick.com/psirt"
},
{
"summary": "SICK Operating Guidelines",
"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
},
{
"summary": "ICS-CERT recommended practices on Industrial Security",
"url": "http://ics-cert.us-cert.gov/content/recommended-practices"
},
{
"summary": "CVSS v3.1 Calculator",
"url": "https://www.first.org/cvss/calculator/3.1"
},
{
"category": "self",
"summary": "The canonical URL.",
"url": "https://www.sick.com/.well-known/csaf/white/2021/sca-2021-0003.json"
}
],
"title": "SICK Security Advisory for Apache Log4j (CVE-2021-44228)",
"tracking": {
"aliases": [
"LOG4SHELL"
],
"current_release_date": "2021-12-17T12:00:00.000Z",
"generator": {
"date": "2023-02-10T07:41:23.369Z",
"engine": {
"name": "Secvisogram",
"version": "2.0.0"
}
},
"id": "SCA-2021-0003",
"initial_release_date": "2021-12-14T17:00:00.000Z",
"revision_history": [
{
"date": "2021-12-14T17:00:00.000Z",
"number": "1",
"summary": "Initial Release"
},
{
"date": "2021-12-16T17:00:00.000Z",
"number": "2",
"summary": "Updated affected products"
},
{
"date": "2021-12-17T12:00:00.000Z",
"number": "3",
"summary": "Updated affected versions"
},
{
"date": "2022-01-14T13:00:00.000Z",
"number": "4",
"summary": "Updated affected products"
},
{
"date": "2022-01-19T11:00:00.000Z",
"number": "5",
"summary": "Updated affected products"
},
{
"date": "2022-02-17T11:00:00.000Z",
"number": "6",
"summary": "Updated affected products"
},
{
"date": "2023-02-10T11:00:00.000Z",
"number": "7",
"summary": "Updated Advisory (only visual changes)"
},
{
"date": "2025-07-30T07:27:50.000Z",
"number": "8",
"summary": "Updated Advisory: URL for SICK Operating Guidelines has been updated"
}
],
"status": "final",
"version": "8"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c1.5.3",
"product": {
"name": "SICK FieldEcho \u003c1.5.3",
"product_id": "CSAFPID-0001",
"product_identification_helper": {
"skus": [
"1612993"
],
"x_generic_uris": [
{
"namespace": "SICK:Website",
"uri": "SICK:Website:https://www.sick.com/de/de/p/p597264"
}
]
}
}
}
],
"category": "product_name",
"name": "FieldEcho"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c1.4.1",
"product": {
"name": "SICK Function Block Factory \u003c1.4.1",
"product_id": "CSAFPID-0002",
"product_identification_helper": {
"x_generic_uris": [
{
"namespace": "SICK:Website",
"uri": "SICK:Website:https://www.sick.com/de/de/p/p653518"
}
]
}
}
}
],
"category": "product_name",
"name": "Function Block Factory"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c1.5.0",
"product": {
"name": "SICK AppManager \u003c1.5.0",
"product_id": "CSAFPID-0003",
"product_identification_helper": {
"x_generic_uris": [
{
"namespace": "SICK:Website",
"uri": "SICK:Website:https://www.sick.com/de/de/p/p532784"
}
]
}
}
}
],
"category": "product_name",
"name": "AppManager"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c1.2.2",
"product": {
"name": "SICK FieldEcho Dashboard \u003c1.2.2",
"product_id": "CSAFPID-0004",
"product_identification_helper": {
"x_generic_uris": [
{
"namespace": "SICK:Website",
"uri": "SICK:Website:https://www.sick.com/de/de/p/p651603"
}
]
}
}
}
],
"category": "product_name",
"name": "FieldEcho Dashboard"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c3.6.0",
"product": {
"name": "SICK AppStudio \u003c3.6.0",
"product_id": "CSAFPID-0005",
"product_identification_helper": {
"skus": [
"1610199"
],
"x_generic_uris": [
{
"namespace": "SICK:Website",
"uri": "SICK:Website:https://www.sick.com/de/de/p/p448644"
}
]
}
}
}
],
"category": "product_name",
"name": "AppStudio"
}
],
"category": "vendor",
"name": "SICK AG"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-44228",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "summary",
"text": "A critical remote code execution vulnerability impacting at least Apache Log4j 2 (versions 2.0 to 2.14.1) was recently announced by Apache. This vulnerability is designated by Mitre as CVE-2021-44228 with the highest severity rating of 10.0. The vulnerability is also known as Log4Shell by security \nresearchers. If exploited, this vulnerability allows adversaries to potentially take full control of the impacted system.\nLog4j 2 is a commonly used open source third party Java logging library used in software applications and services.",
"title": "Summary"
}
],
"product_status": {
"fixed": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005"
]
},
"references": [
{
"category": "external",
"summary": "Apache Security Advisory",
"url": "https://logging.apache.org/log4j/2.x/security.html"
},
{
"category": "external",
"summary": "CVE Entry",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Fixed on vendorside",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
]
}
]
}
SESB-2021-347-01
Vulnerability from csaf_se - Published: 2021-12-13 09:22 - Updated: 2022-08-09 09:22| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Schneider Electric APC PowerChute Business Edition version 9.5
Schneider Electric / APC PowerChute Business Edition
|
9.5 |
Vendor Fix
fix
|
|
|
Schneider Electric APC PowerChute Business Edition version 10.0
Schneider Electric / APC PowerChute Business Edition
|
10.0 |
Vendor Fix
fix
|
|
|
Schneider Electric APC PowerChute Business Edition version 10.0.1
Schneider Electric / APC PowerChute Business Edition
|
10.0.1 |
Vendor Fix
fix
|
|
|
Schneider Electric APC PowerChute Business Edition version 10.0.2
Schneider Electric / APC PowerChute Business Edition
|
10.0.2 |
Vendor Fix
fix
|
|
|
Schneider Electric APC PowerChute Business Edition version 10.0.3
Schneider Electric / APC PowerChute Business Edition
|
10.0.3 |
Vendor Fix
fix
|
|
|
Schneider Electric APC PowerChute Business Edition version 10.0.4
Schneider Electric / APC PowerChute Business Edition
|
10.0.4 |
Vendor Fix
fix
|
|
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.4.1
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.4.1 |
Vendor Fix
|
|
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.4
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.4 |
Vendor Fix
|
|
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.3
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.3 |
Vendor Fix
|
|
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.2
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.2 |
Vendor Fix
|
|
|
Schneider Electric EcoStruxure™ IT Gateway <=1.5.0|>=1.13.1.5
Schneider Electric / EcoStruxure™ IT Gateway
|
<=1.5.0|>=1.13.1.5 |
Vendor Fix
|
|
|
Schneider Electric Eurotherm Data Reviewer software version 3.0.2 and prior
Schneider Electric / Eurotherm Data Reviewer software
|
<=3.0.2 |
Vendor Fix
fix
|
|
|
Schneider Electric Harmony Configurator version 33 and prior
Schneider Electric / Harmony Configurator
|
<=33 |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Schneider Electric APC PowerChute Business Edition version 10.0.5
Schneider Electric / APC PowerChute Business Edition
|
10.0.5 | ||
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.5 and earlier
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
>=4.5 | ||
|
Schneider Electric EcoStruxure™ IT Gateway version 1.13.2.3
Schneider Electric / EcoStruxure™ IT Gateway
|
1.13.2.3 | ||
|
Schneider Electric EcoStruxure™ IT Expert Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric EMA Server Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric Eurotherm Data Reviewer software version 4.0.0
Schneider Electric / Eurotherm Data Reviewer software
|
4.0.0 | ||
|
Schneider Electric Facility Expert Small Business Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric MSE Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric NetBotz 750/755 <=5.0|>=5.3.0
Schneider Electric / NetBotz 750/755
|
<=5.0|>=5.3.0 |
Vendor Fix
|
|
|
Schneider Electric SDK-Docgen Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric SDK-UMS Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric Select and Config DATA Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric SNC-API Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric SNC-CMM Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric SNC-SEMTECH Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric TwinBus IP (formerly Digides 2.0) Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric Workplace Advisor
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric Wiser™ by SE Platform Cloud
Schneider Electric
|
— |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Schneider Electric APC PowerChute Business Edition version 9.5
Schneider Electric / APC PowerChute Business Edition
|
9.5 |
Vendor Fix
fix
|
|
|
Schneider Electric APC PowerChute Business Edition version 10.0
Schneider Electric / APC PowerChute Business Edition
|
10.0 |
Vendor Fix
fix
|
|
|
Schneider Electric APC PowerChute Business Edition version 10.0.1
Schneider Electric / APC PowerChute Business Edition
|
10.0.1 |
Vendor Fix
fix
|
|
|
Schneider Electric APC PowerChute Business Edition version 10.0.2
Schneider Electric / APC PowerChute Business Edition
|
10.0.2 |
Vendor Fix
fix
|
|
|
Schneider Electric APC PowerChute Business Edition version 10.0.3
Schneider Electric / APC PowerChute Business Edition
|
10.0.3 |
Vendor Fix
fix
|
|
|
Schneider Electric APC PowerChute Business Edition version 10.0.4
Schneider Electric / APC PowerChute Business Edition
|
10.0.4 |
Vendor Fix
fix
|
|
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.4.1
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.4.1 |
Vendor Fix
|
|
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.4
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.4 |
Vendor Fix
|
|
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.3
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.3 |
Vendor Fix
|
|
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.2
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.2 |
Vendor Fix
|
|
|
Schneider Electric EcoStruxure™ IT Gateway <=1.5.0|>=1.13.1.5
Schneider Electric / EcoStruxure™ IT Gateway
|
<=1.5.0|>=1.13.1.5 |
Vendor Fix
|
|
|
Schneider Electric Harmony Configurator version 33 and prior
Schneider Electric / Harmony Configurator
|
<=33 |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Schneider Electric EcoStruxure™ IT Expert Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric Facility Expert Small Business Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric MSE Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric NetBotz 750/755 <=5.0|>=5.3.0
Schneider Electric / NetBotz 750/755
|
<=5.0|>=5.3.0 |
Vendor Fix
|
|
|
Schneider Electric SDK-Docgen Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric SDK-UMS Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric Select and Config DATA Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric SNC-API Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric SNC-CMM Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric SNC-SEMTECH Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric TwinBus IP (formerly Digides 2.0) Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric Wiser™ by SE Platform Cloud
Schneider Electric
|
— |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Schneider Electric EcoStruxure™ IT Gateway <=1.5.0|>=1.13.1.5
Schneider Electric / EcoStruxure™ IT Gateway
|
<=1.5.0|>=1.13.1.5 |
Vendor Fix
|
|
|
Schneider Electric Harmony Configurator version 33 and prior
Schneider Electric / Harmony Configurator
|
<=33 |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Schneider Electric APC PowerChute Business Edition version 10.0.5
Schneider Electric / APC PowerChute Business Edition
|
10.0.5 | ||
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.5 and earlier
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
>=4.5 | ||
|
Schneider Electric EcoStruxure™ IT Expert Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric Facility Expert Small Business Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric MSE Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric NetBotz 750/755 <=5.0|>=5.3.0
Schneider Electric / NetBotz 750/755
|
<=5.0|>=5.3.0 | ||
|
Schneider Electric SDK-Docgen Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric SDK-UMS Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric Select and Config DATA Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric SNC-API Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric SNC-CMM Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric SNC-SEMTECH Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric TwinBus IP (formerly Digides 2.0) Cloud
Schneider Electric
|
— |
Vendor Fix
|
|
|
Schneider Electric Wiser™ by SE Platform Cloud
Schneider Electric
|
— |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Schneider Electric APC PowerChute Business Edition version 9.5
Schneider Electric / APC PowerChute Business Edition
|
9.5 | ||
|
Schneider Electric APC PowerChute Business Edition version 10.0
Schneider Electric / APC PowerChute Business Edition
|
10.0 | ||
|
Schneider Electric APC PowerChute Business Edition version 10.0.1
Schneider Electric / APC PowerChute Business Edition
|
10.0.1 | ||
|
Schneider Electric APC PowerChute Business Edition version 10.0.2
Schneider Electric / APC PowerChute Business Edition
|
10.0.2 | ||
|
Schneider Electric APC PowerChute Business Edition version 10.0.3
Schneider Electric / APC PowerChute Business Edition
|
10.0.3 | ||
|
Schneider Electric APC PowerChute Business Edition version 10.0.4
Schneider Electric / APC PowerChute Business Edition
|
10.0.4 | ||
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.4.1
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.4.1 | ||
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.4
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.4 | ||
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.3
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.3 | ||
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.2
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.2 | ||
|
Schneider Electric EcoStruxure™ IT Gateway <=1.5.0|>=1.13.1.5
Schneider Electric / EcoStruxure™ IT Gateway
|
<=1.5.0|>=1.13.1.5 | ||
|
Schneider Electric Eurotherm Data Reviewer software version 3.0.2 and prior
Schneider Electric / Eurotherm Data Reviewer software
|
<=3.0.2 | ||
|
Schneider Electric Harmony Configurator version 33 and prior
Schneider Electric / Harmony Configurator
|
<=33 |
Log4j is an open-source Java logging library developed by the Apache Foundation which is widely used by both enterprise applications and cloud services. The recent Apache Log4j vulnerabilities are listed below and have ratings ranging from High to Critical. CVE-2021-44228 (Log4Shell), received a rating of Critical and can allow an attacker who can control log messages or log message parameters to execute arbitrary code loaded from LDAP servers and other JNDI related endpoints when message lookup substitution is enabled. Exploitation could allow for unauthenticated remote code execution (RCE) and possibly access to servers. Additional CVEs within the scope of this security notification: CVE-2021-44228 CVE-2021-45046 CVE-2021-45105 CVE-2021-4104 CVE-2021-44832 For more information, please visit the Apache logging services log4j security page https://logging.apache.org/log4j/2.x/security.html.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Schneider Electric APC PowerChute Business Edition version 9.5
Schneider Electric / APC PowerChute Business Edition
|
9.5 | ||
|
Schneider Electric APC PowerChute Business Edition version 10.0
Schneider Electric / APC PowerChute Business Edition
|
10.0 | ||
|
Schneider Electric APC PowerChute Business Edition version 10.0.1
Schneider Electric / APC PowerChute Business Edition
|
10.0.1 | ||
|
Schneider Electric APC PowerChute Business Edition version 10.0.2
Schneider Electric / APC PowerChute Business Edition
|
10.0.2 | ||
|
Schneider Electric APC PowerChute Business Edition version 10.0.3
Schneider Electric / APC PowerChute Business Edition
|
10.0.3 | ||
|
Schneider Electric APC PowerChute Business Edition version 10.0.4
Schneider Electric / APC PowerChute Business Edition
|
10.0.4 | ||
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.4.1
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.4.1 | ||
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.4
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.4 | ||
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.3
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.3 | ||
|
Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.2
Schneider Electric / APC PowerChute Network Shutdown (PCNS)
|
4.2 | ||
|
Schneider Electric EcoStruxure™ IT Gateway <=1.5.0|>=1.13.1.5
Schneider Electric / EcoStruxure™ IT Gateway
|
<=1.5.0|>=1.13.1.5 | ||
|
Schneider Electric Eurotherm Data Reviewer software version 3.0.2 and prior
Schneider Electric / Eurotherm Data Reviewer software
|
<=3.0.2 | ||
|
Schneider Electric Harmony Configurator version 33 and prior
Schneider Electric / Harmony Configurator
|
<=33 |
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "We strongly recommend the following industry cybersecurity best practices.\n\nhttps://www.se.com/us/en/download/document/7EN52-0390/\n* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.\n* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.\n* Place all controllers in locked cabinets and never leave them in the \u201cProgram\u201d mode.\n* Never connect programming software to any network other than the network intended for that device.\n* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.\n* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.\n* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.\n* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.\nFor more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document. \n",
"title": "General Security Recommendations"
},
{
"category": "general",
"text": "This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.\nFor further information related to cybersecurity in Schneider Electric\u2019s products, visit the company\u2019s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp",
"title": "For More Information"
},
{
"category": "legal_disclaimer",
"text": "THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS \u201cNOTIFICATION\u201d) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN \u201cAS-IS\u201d BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION",
"title": "LEGAL DISCLAIMER"
},
{
"category": "general",
"text": "At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.\n\nWe provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.\n\nWe are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.\n\nwww.se.com ",
"title": "About Schneider Electric"
},
{
"category": "summary",
"text": "Schneider Electric is aware of the vulnerabilities impacting Apache Log4j, including CVE-2021-44228, also known as Log4Shell. Our cybersecurity team is actively investigating the impact of the vulnerability on Schneider Electric offers and will continuously update this notification as information becomes available.\r\nIn the meantime, customers should immediately ensure they have implemented cybersecurity best practices across their operations to protect themselves from exploitation of this vulnerability. Where appropriate, this includes locating their systems and remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized access; preventing mission-critical systems and devices from being accessed from outside networks; and following the recommended mitigations and general security recommendations below.\r\nPlease subscribe to the Schneider Electric security notification service to be informed of critical updates to this notification, including information on affected products and remediation plans:\r\nhttps://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp\r\nFor additional information and support, please contact your Schneider Electric sales or service representative or Schneider Electric\u2019s Customer Care Center.\r\nAugust 2022 Update: Remediation update for Eurotherm Data Reviewer.",
"title": "Overview"
}
],
"publisher": {
"category": "vendor",
"contact_details": "cybersecurity@se.com",
"name": "Schneider Electric CPCERT",
"namespace": "https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp"
},
"references": [
{
"category": "self",
"summary": "Apache Log4j Vulnerabilities (Log4Shell) - SESB-2021-347-01 PDF Version",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SESB-2021-347-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SESB-2021-347-01_Apache_Log4j_Log4Shell_Vulnerabilities_Security_Notification.pdf"
},
{
"category": "self",
"summary": "Apache Log4j Vulnerabilities (Log4Shell) - SESB-2021-347-01 CSAF Version",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SESB-2021-347-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=sesb-2021-347-01.json"
},
{
"category": "external",
"summary": "Recommended Cybersecurity Best Practices",
"url": "https://www.se.com/us/en/download/document/7EN52-0390/"
}
],
"title": "Apache Log4j Vulnerabilities (Log4Shell)",
"tracking": {
"current_release_date": "2022-08-09T09:22:58.000Z",
"generator": {
"date": "2022-10-06T11:41:22.636Z",
"engine": {
"name": "Schneider Electric CSAF Generator",
"version": "1.2"
}
},
"id": "SESB-2021-347-01",
"initial_release_date": "2021-12-13T09:22:58.000Z",
"revision_history": [
{
"date": "2021-12-13T09:22:58.000Z",
"number": "1.0.0",
"summary": "Original Release"
},
{
"date": "2021-12-15T09:22:58.000Z",
"number": "2.0.0",
"summary": "EcoStruxure\u2122 IT Gateway and EcoStruxure\u2122 IT Expert added to available remediations section"
},
{
"date": "2021-12-16T09:22:58.000Z",
"number": "3.0.0",
"summary": "APC PowerChute Business Edition and APC PowerChute Network Shutdown added to affected products section"
},
{
"date": "2021-12-17T09:22:58.000Z",
"number": "4.0.0",
"summary": "Overview updated to include CVE-2021-45046, Facility Expert Small Business and Wiser by SE platform added to list of available remediations, EASYFIT, Ecoreal XL, Eurotherm Data Reviewer, MSE, NetBotz750/75, NEW630, SDK BOM, SDK-Docgen, SDK-TNC, SDK-UMS, SDK3D-2DRenderer, SDK3D-360Widget, SNC-API, SNC-CMM, SNC-SEMTECH, SPIMV3, SWBEditor, SWBEngine added to list of affected products."
},
{
"date": "2021-12-21T09:22:58.000Z",
"number": "5.0.0",
"summary": "CVE-2021-4104 added to the scope of this security notification."
},
{
"date": "2021-12-23T09:22:58.000Z",
"number": "6.0.0",
"summary": "-Updated information for Facility Expert SmallBusiness and Wiser by SE Platform in availableremediations section (page 3)\r\n-Workplace Advisor added to list of affectedoffers (page 7)"
},
{
"date": "2021-12-23T09:22:58.000Z",
"number": "7.0.0",
"summary": "-Updated information for Facility Expert SmallBusiness and Wiser by SE Platform and addedHarmony Configurator, MSE, NetBotz750/755,SDK-Docgen, SDK-UMS, SNC-API, SNC-CMM,SNC-SEMTECH to list available remediations.(page 3-4)\r\n-Upon further investigation the following productshave been determined to not be affected by theLog4j vulnerabilities and have been removedfrom the list of affected offers: EASYFIT,Ecoreal XL, NEW630, SDK BOM, SDK-TNC ,SDK3D-2DRenderer, SDK3D-360Widget,SPIMV3, SWBEditor, SWBEngine"
},
{
"date": "2021-12-24T09:22:58.000Z",
"number": "8.0.0",
"summary": "Added TwinBus IP (formerly Digides 2.0) and Select and Config DATA to list available remediations. (page 3 and 4)"
},
{
"date": "2021-12-29T09:22:58.000Z",
"number": "8.1.0",
"summary": "Added CVE-2021-44832 to the scope of this security notification (page 1)"
},
{
"date": "2022-01-13T09:22:58.000Z",
"number": "9.0.0",
"summary": "Remediations updated for EcoStruxure\u2122 IT Gateway \u0026 EcoStruxure\u2122 IT Expert to address CVE-2021-45105."
},
{
"date": "2022-02-01T09:22:58.000Z",
"number": "10.0.0",
"summary": "Netbotz remediation updated due to stability issue on version 5.3.1."
},
{
"date": "2022-03-08T09:22:58.000Z",
"number": "11.0.0",
"summary": "Remediation available for APC PowerChute Business Edition, APC PowerChute Network Edition, and EMA Server."
},
{
"date": "2022-03-30T09:22:58.000Z",
"number": "12.0.0",
"summary": "Remediation update for Workplace Advisor."
},
{
"date": "2022-08-09T09:22:58.000Z",
"number": "13.0.0",
"summary": "Remediation update for Eurotherm Data Reviewer."
},
{
"date": "2022-11-10T00:00:00.000Z",
"number": "14.0.0",
"summary": "A remediation is now available for Netbotz 750/755"
}
],
"status": "final",
"version": "14.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "9.5",
"product": {
"name": "Schneider Electric APC PowerChute Business Edition version 9.5",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "10.0",
"product": {
"name": "Schneider Electric APC PowerChute Business Edition version 10.0",
"product_id": "CSAFPID-0002"
}
},
{
"category": "product_version",
"name": "10.0.1",
"product": {
"name": "Schneider Electric APC PowerChute Business Edition version 10.0.1",
"product_id": "CSAFPID-0003"
}
},
{
"category": "product_version",
"name": "10.0.2",
"product": {
"name": "Schneider Electric APC PowerChute Business Edition version 10.0.2",
"product_id": "CSAFPID-0004"
}
},
{
"category": "product_version",
"name": "10.0.3",
"product": {
"name": "Schneider Electric APC PowerChute Business Edition version 10.0.3",
"product_id": "CSAFPID-0005"
}
},
{
"category": "product_version",
"name": "10.0.4",
"product": {
"name": "Schneider Electric APC PowerChute Business Edition version 10.0.4",
"product_id": "CSAFPID-0006"
}
},
{
"category": "product_version",
"name": "10.0.5",
"product": {
"name": "Schneider Electric APC PowerChute Business Edition version 10.0.5",
"product_id": "CSAFPID-0007"
}
}
],
"category": "product_name",
"name": "APC PowerChute Business Edition"
},
{
"branches": [
{
"category": "product_version",
"name": "4.4.1",
"product": {
"name": "Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.4.1",
"product_id": "CSAFPID-0008"
}
},
{
"category": "product_version",
"name": "4.4",
"product": {
"name": "Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.4",
"product_id": "CSAFPID-0009"
}
},
{
"category": "product_version",
"name": "4.3",
"product": {
"name": "Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.3",
"product_id": "CSAFPID-0010"
}
},
{
"category": "product_version",
"name": "4.2",
"product": {
"name": "Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.2",
"product_id": "CSAFPID-0011"
}
},
{
"category": "product_version_range",
"name": "\u003e=4.5",
"product": {
"name": "Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.5 and earlier",
"product_id": "CSAFPID-0012"
}
}
],
"category": "product_name",
"name": "APC PowerChute Network Shutdown (PCNS)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c=1.5.0|\u003e=1.13.1.5",
"product": {
"name": "Schneider Electric EcoStruxure\u2122 IT Gateway \u003c=1.5.0|\u003e=1.13.1.5",
"product_id": "CSAFPID-0013"
}
},
{
"category": "product_version",
"name": "1.13.2.3",
"product": {
"name": "Schneider Electric EcoStruxure\u2122 IT Gateway version 1.13.2.3",
"product_id": "CSAFPID-0014"
}
}
],
"category": "product_name",
"name": "EcoStruxure\u2122 IT Gateway"
},
{
"category": "product_name",
"name": "EcoStruxure\u2122 IT Expert Cloud",
"product": {
"name": "Schneider Electric EcoStruxure\u2122 IT Expert Cloud",
"product_id": "CSAFPID-0015"
}
},
{
"category": "product_name",
"name": "EMA Server Cloud",
"product": {
"name": "Schneider Electric EMA Server Cloud",
"product_id": "CSAFPID-0016"
}
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c=3.0.2",
"product": {
"name": "Schneider Electric Eurotherm Data Reviewer software version 3.0.2 and prior",
"product_id": "CSAFPID-0017"
}
},
{
"category": "product_version",
"name": "4.0.0",
"product": {
"name": "Schneider Electric Eurotherm Data Reviewer software version 4.0.0",
"product_id": "CSAFPID-0018"
}
}
],
"category": "product_name",
"name": "Eurotherm Data Reviewer software"
},
{
"category": "product_name",
"name": "Facility Expert Small Business Cloud",
"product": {
"name": "Schneider Electric Facility Expert Small Business Cloud",
"product_id": "CSAFPID-0019"
}
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c=33",
"product": {
"name": "Schneider Electric Harmony Configurator version 33 and prior",
"product_id": "CSAFPID-0020"
}
}
],
"category": "product_name",
"name": "Harmony Configurator"
},
{
"category": "product_name",
"name": "MSE Cloud",
"product": {
"name": "Schneider Electric MSE Cloud",
"product_id": "CSAFPID-0021"
}
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c=5.0|\u003e=5.3.0",
"product": {
"name": "Schneider Electric NetBotz 750/755 \u003c=5.0|\u003e=5.3.0",
"product_id": "CSAFPID-0022"
}
}
],
"category": "product_name",
"name": "NetBotz 750/755"
},
{
"category": "product_name",
"name": "SDK-Docgen Cloud",
"product": {
"name": "Schneider Electric SDK-Docgen Cloud",
"product_id": "CSAFPID-0023"
}
},
{
"category": "product_name",
"name": "SDK-UMS Cloud",
"product": {
"name": "Schneider Electric SDK-UMS Cloud",
"product_id": "CSAFPID-0024"
}
},
{
"category": "product_name",
"name": "Select and Config DATA Cloud",
"product": {
"name": "Schneider Electric Select and Config DATA Cloud",
"product_id": "CSAFPID-0025"
}
},
{
"category": "product_name",
"name": "SNC-API Cloud",
"product": {
"name": "Schneider Electric SNC-API Cloud",
"product_id": "CSAFPID-0026"
}
},
{
"category": "product_name",
"name": "SNC-CMM Cloud",
"product": {
"name": "Schneider Electric SNC-CMM Cloud",
"product_id": "CSAFPID-0027"
}
},
{
"category": "product_name",
"name": "SNC-SEMTECH Cloud",
"product": {
"name": "Schneider Electric SNC-SEMTECH Cloud",
"product_id": "CSAFPID-0028"
}
},
{
"category": "product_name",
"name": "TwinBus IP (formerly Digides 2.0) Cloud",
"product": {
"name": "Schneider Electric TwinBus IP (formerly Digides 2.0) Cloud",
"product_id": "CSAFPID-0029"
}
},
{
"category": "product_name",
"name": "Workplace Advisor",
"product": {
"name": "Schneider Electric Workplace Advisor",
"product_id": "CSAFPID-0030"
}
},
{
"category": "product_name",
"name": "Wiser\u2122 by SE Platform Cloud",
"product": {
"name": "Schneider Electric Wiser\u2122 by SE Platform Cloud",
"product_id": "CSAFPID-0031"
}
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c=3.0.2",
"product": {
"name": "Schneider Electric Eurotherm Data Reviewer version 3.0.2 and prior",
"product_id": "CSAFPID-0032"
}
}
],
"category": "product_name",
"name": "Eurotherm Data Reviewer"
}
],
"category": "vendor",
"name": "Schneider Electric"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-44228",
"notes": [
{
"category": "details",
"text": "Log4j is an open-source Java logging library developed by the Apache Foundation which is widely used by both enterprise applications and cloud services. The recent Apache Log4j vulnerabilities are listed below and have ratings ranging from High to Critical. CVE-2021-44228 (Log4Shell), received a rating of Critical and can allow an attacker who can control log messages or log message parameters to execute arbitrary code loaded from LDAP servers and other JNDI related endpoints when message lookup substitution is enabled. Exploitation could allow for unauthenticated remote code execution (RCE) and possibly access to servers. Additional CVEs within the scope of this security notification:\nCVE-2021-44228\nCVE-2021-45046\nCVE-2021-45105\nCVE-2021-4104\nCVE-2021-44832\nFor more information, please visit the Apache logging services log4j security page https://logging.apache.org/log4j/2.x/security.html."
}
],
"product_status": {
"fixed": [
"CSAFPID-0007",
"CSAFPID-0012",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0021",
"CSAFPID-0022",
"CSAFPID-0023",
"CSAFPID-0024",
"CSAFPID-0025",
"CSAFPID-0026",
"CSAFPID-0027",
"CSAFPID-0028",
"CSAFPID-0029",
"CSAFPID-0030",
"CSAFPID-0031"
],
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0013",
"CSAFPID-0017",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update SDK-UMS to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0024"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update Select and Config DATA to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0025"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update SNC-API to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0026"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update SNC-CMM to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0027"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update SNC-SEMTECH to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0028"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update TwinBus IP to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0029"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update Workplace Advisor to Log4j 2.17.\r\nThese fixes were deployed implemented on all public facing portals on January 14, 2022 and require no action from customers.",
"product_ids": [
"CSAFPID-0030"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update the Wiser by SE Platform to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0031"
],
"restart_required": {
"category": "none"
}
},
{
"category": "mitigation",
"details": "Schneider Electric is establishing a remediation plan for all future versions of Eurotherm Data Reviewer that will include a fix for this vulnerability. We will update this document when the remediation is available. Until then, customers should immediately apply the mitigations found in the document below to reduce the risk of exploit:\r\nhttps://download.schneider-electric.com/files?p_Doc_Ref=EDR-Log4Shell-Mitigations\r\nThe above settings change will not alter the behavior of the Eurotherm Data Reviewer software\r\nNote: Eurotherm Data Reviewer uses a defense-in-depth strategy for security. It is currently not possible to exploit this vulnerability without logging into the server hosting Reviewer with administrator privileges",
"product_ids": [
"CSAFPID-0032"
],
"restart_required": {
"category": "none"
},
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=EDR-Log4Shell-Mitigations"
},
{
"category": "mitigation",
"details": "Customers should use an IoT/OT-aware network detection and response (NDR) solution and SIEM/SOAR solution to auto-discover and continuously monitor devices for anomalous or unauthorized behaviors, such as communication with unfamiliar local or remote hosts.",
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "PowerChute Business Edition V10.0.5 has been updated with log4j V 2.17.0 which includes a fix for these vulnerabilities and can be downloaded here: https://www.apc.com/shop/us/en/products/PowerChute-Business-Edition-v10-0-5/P-SFPCBE1005\n10.0.5 Release Notes:\nhttps://download.schneider-electric.com/files?p_File_Name=990-3029P-EN.pdf\u0026p_Doc_Ref=SPD_CCON-AT6CWT_EN\u0026p_enDocType=User+guide\nFor more information, please see this FAQ: https://www.apc.com/my/en/faqs/FAQ000229596/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://www.apc.com/shop/us/en/products/PowerChute-Business-Edition-v10-0-5/P-SFPCBE1005"
},
{
"category": "vendor_fix",
"details": "For PowerChute Network Shutdown customers who would like to use Dell VxRail enabled NMC cards, please update to version PCNS 4.5 or later, which includes a fix for these vulnerabilities. Otherwise, customers on PowerChute Network Shutdown versions 4.3, 4.4, and 4.4.1 should follow these remediations steps:\n\u2022Download the corresponding V4.4.1.1, 4.4.0.1,4.3.0.1 scripts and follow the instructions available athttps://www.apc.com/my/en/faqs/FAQ000229596/.\n\u2022These scripts remove the vulnerable log4j files andreplace them with log4j V2.17.1 files, which include afix for these vulnerabilities.",
"product_ids": [
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
{
"category": "vendor_fix",
"details": "Version 1.13.2.3 of EcoStruxure\u2122 IT Gateway has been\nupdated with log4j V2.17.0, which includes a fix for these\nvulnerabilities, and is available via automatic update if\nenabled.\nUpdate manually by logging into EcoStruxureit.com, or by downloading the update directly from here: https://EcoStruxureit.com/download-and-set-up-EcoStruxurit-gateway/",
"product_ids": [
"CSAFPID-0013"
]
},
{
"category": "vendor_fix",
"details": "The cloud-based EcoStruxure\u2122 IT Expert has been updated has been updated with log4j V2.17, which includes a fix for these vulnerabilities.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0015"
]
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update EMA Server cloud offer to Log4j2.17.1.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0016"
]
},
{
"category": "vendor_fix",
"details": "Version 4.0.0of Eurotherm Data Reviewer includes a fix for this vulnerability and is available for download here:\nhttps://www.eurotherm.com/?wpdmdl=78469",
"product_ids": [
"CSAFPID-0017"
],
"url": "https://www.eurotherm.com/?wpdmdl=78469"
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update the Facility Expert Small Business cloud application to Log4j 2.17.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0019"
]
},
{
"category": "vendor_fix",
"details": "Harmony Configurator has been updated with log4j V2.17, which includes a fix for these vulnerabilities.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0020"
]
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update MSE to Log4j 2.17.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0021"
]
},
{
"category": "vendor_fix",
"details": "For software V5.0.1 - 5.3.x of Netbotz 750/755 there is a patch that includes a fix for this vulnerability.\nThe patch is available thru your local tech support who can be reached here: https://www.se.com/ww/en/work/support/country-selector/contact-us.jsp",
"product_ids": [
"CSAFPID-0022"
]
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update SDK-Docgen to Log4j 2.17.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0023"
]
}
],
"title": "CVE-2021-44228"
},
{
"cve": "CVE-2021-45046",
"notes": [
{
"category": "details",
"text": "Log4j is an open-source Java logging library developed by the Apache Foundation which is widely used by both enterprise applications and cloud services. The recent Apache Log4j vulnerabilities are listed below and have ratings ranging from High to Critical. CVE-2021-44228 (Log4Shell), received a rating of Critical and can allow an attacker who can control log messages or log message parameters to execute arbitrary code loaded from LDAP servers and other JNDI related endpoints when message lookup substitution is enabled. Exploitation could allow for unauthenticated remote code execution (RCE) and possibly access to servers. Additional CVEs within the scope of this security notification:\nCVE-2021-44228\nCVE-2021-45046\nCVE-2021-45105\nCVE-2021-4104\nCVE-2021-44832\nFor more information, please visit the Apache logging services log4j security page https://logging.apache.org/log4j/2.x/security.html."
}
],
"product_status": {
"fixed": [
"CSAFPID-0015",
"CSAFPID-0019",
"CSAFPID-0021",
"CSAFPID-0022",
"CSAFPID-0023",
"CSAFPID-0024",
"CSAFPID-0025",
"CSAFPID-0026",
"CSAFPID-0027",
"CSAFPID-0028",
"CSAFPID-0029",
"CSAFPID-0031"
],
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0013",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update SDK-UMS to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0024"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update Select and Config DATA to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0025"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update SNC-API to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0026"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update SNC-CMM to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0027"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update SNC-SEMTECH to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0028"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update TwinBus IP to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0029"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update the Wiser by SE Platform to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0031"
],
"restart_required": {
"category": "none"
}
},
{
"category": "mitigation",
"details": "Schneider Electric is establishing a remediation plan for all future versions of Eurotherm Data Reviewer that will include a fix for this vulnerability. We will update this document when the remediation is available. Until then, customers should immediately apply the mitigations found in the document below to reduce the risk of exploit:\r\nhttps://download.schneider-electric.com/files?p_Doc_Ref=EDR-Log4Shell-Mitigations\r\nThe above settings change will not alter the behavior of the Eurotherm Data Reviewer software\r\nNote: Eurotherm Data Reviewer uses a defense-in-depth strategy for security. It is currently not possible to exploit this vulnerability without logging into the server hosting Reviewer with administrator privileges",
"product_ids": [
"CSAFPID-0032"
],
"restart_required": {
"category": "none"
},
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=EDR-Log4Shell-Mitigations"
},
{
"category": "mitigation",
"details": "Customers should use an IoT/OT-aware network detection and response (NDR) solution and SIEM/SOAR solution to auto-discover and continuously monitor devices for anomalous or unauthorized behaviors, such as communication with unfamiliar local or remote hosts.",
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "PowerChute Business Edition V10.0.5 has been updated with log4j V 2.17.0 which includes a fix for these vulnerabilities and can be downloaded here: https://www.apc.com/shop/us/en/products/PowerChute-Business-Edition-v10-0-5/P-SFPCBE1005\n10.0.5 Release Notes:\nhttps://download.schneider-electric.com/files?p_File_Name=990-3029P-EN.pdf\u0026p_Doc_Ref=SPD_CCON-AT6CWT_EN\u0026p_enDocType=User+guide\nFor more information, please see this FAQ: https://www.apc.com/my/en/faqs/FAQ000229596/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://www.apc.com/shop/us/en/products/PowerChute-Business-Edition-v10-0-5/P-SFPCBE1005"
},
{
"category": "vendor_fix",
"details": "For PowerChute Network Shutdown customers who would like to use Dell VxRail enabled NMC cards, please update to version PCNS 4.5 or later, which includes a fix for these vulnerabilities. Otherwise, customers on PowerChute Network Shutdown versions 4.3, 4.4, and 4.4.1 should follow these remediations steps:\n\u2022Download the corresponding V4.4.1.1, 4.4.0.1,4.3.0.1 scripts and follow the instructions available athttps://www.apc.com/my/en/faqs/FAQ000229596/.\n\u2022These scripts remove the vulnerable log4j files andreplace them with log4j V2.17.1 files, which include afix for these vulnerabilities.",
"product_ids": [
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
{
"category": "vendor_fix",
"details": "Version 1.13.2.3 of EcoStruxure\u2122 IT Gateway has been\nupdated with log4j V2.17.0, which includes a fix for these\nvulnerabilities, and is available via automatic update if\nenabled.\nUpdate manually by logging into EcoStruxureit.com, or by downloading the update directly from here: https://EcoStruxureit.com/download-and-set-up-EcoStruxurit-gateway/",
"product_ids": [
"CSAFPID-0013"
]
},
{
"category": "vendor_fix",
"details": "The cloud-based EcoStruxure\u2122 IT Expert has been updated has been updated with log4j V2.17, which includes a fix for these vulnerabilities.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0015"
]
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update the Facility Expert Small Business cloud application to Log4j 2.17.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0019"
]
},
{
"category": "vendor_fix",
"details": "Harmony Configurator has been updated with log4j V2.17, which includes a fix for these vulnerabilities.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0020"
]
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update MSE to Log4j 2.17.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0021"
]
},
{
"category": "vendor_fix",
"details": "For software V5.0.1 - 5.3.x of Netbotz 750/755 there is a patch that includes a fix for this vulnerability.\nThe patch is available thru your local tech support who can be reached here: https://www.se.com/ww/en/work/support/country-selector/contact-us.jsp",
"product_ids": [
"CSAFPID-0022"
]
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update SDK-Docgen to Log4j 2.17.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0023"
]
}
],
"title": "CVE-2021-45046"
},
{
"cve": "CVE-2021-45105",
"notes": [
{
"category": "details",
"text": "Log4j is an open-source Java logging library developed by the Apache Foundation which is widely used by both enterprise applications and cloud services. The recent Apache Log4j vulnerabilities are listed below and have ratings ranging from High to Critical. CVE-2021-44228 (Log4Shell), received a rating of Critical and can allow an attacker who can control log messages or log message parameters to execute arbitrary code loaded from LDAP servers and other JNDI related endpoints when message lookup substitution is enabled. Exploitation could allow for unauthenticated remote code execution (RCE) and possibly access to servers. Additional CVEs within the scope of this security notification:\nCVE-2021-44228\nCVE-2021-45046\nCVE-2021-45105\nCVE-2021-4104\nCVE-2021-44832\nFor more information, please visit the Apache logging services log4j security page https://logging.apache.org/log4j/2.x/security.html."
}
],
"product_status": {
"fixed": [
"CSAFPID-0007",
"CSAFPID-0012",
"CSAFPID-0015",
"CSAFPID-0019",
"CSAFPID-0021",
"CSAFPID-0022",
"CSAFPID-0023",
"CSAFPID-0024",
"CSAFPID-0025",
"CSAFPID-0026",
"CSAFPID-0027",
"CSAFPID-0028",
"CSAFPID-0029",
"CSAFPID-0031"
],
"known_affected": [
"CSAFPID-0013",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update SDK-UMS to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0024"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update Select and Config DATA to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0025"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update SNC-API to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0026"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update SNC-CMM to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0027"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update SNC-SEMTECH to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0028"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update TwinBus IP to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0029"
],
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update the Wiser by SE Platform to Log4j 2.17.\r\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0031"
],
"restart_required": {
"category": "none"
}
},
{
"category": "mitigation",
"details": "Customers should use an IoT/OT-aware network detection and response (NDR) solution and SIEM/SOAR solution to auto-discover and continuously monitor devices for anomalous or unauthorized behaviors, such as communication with unfamiliar local or remote hosts.",
"restart_required": {
"category": "none"
}
},
{
"category": "vendor_fix",
"details": "Version 1.13.2.3 of EcoStruxure\u2122 IT Gateway has been\nupdated with log4j V2.17.0, which includes a fix for these\nvulnerabilities, and is available via automatic update if\nenabled.\nUpdate manually by logging into EcoStruxureit.com, or by downloading the update directly from here: https://EcoStruxureit.com/download-and-set-up-EcoStruxurit-gateway/",
"product_ids": [
"CSAFPID-0013"
]
},
{
"category": "vendor_fix",
"details": "The cloud-based EcoStruxure\u2122 IT Expert has been updated has been updated with log4j V2.17, which includes a fix for these vulnerabilities.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0015"
]
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update the Facility Expert Small Business cloud application to Log4j 2.17.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0019"
]
},
{
"category": "vendor_fix",
"details": "Harmony Configurator has been updated with log4j V2.17, which includes a fix for these vulnerabilities.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0020"
]
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update MSE to Log4j 2.17.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0021"
]
},
{
"category": "vendor_fix",
"details": "Schneider Electric has deployed a fix to update SDK-Docgen to Log4j 2.17.\nThese fixes have been deployed automatically and require no action from customers.",
"product_ids": [
"CSAFPID-0023"
]
}
],
"title": "CVE-2021-45105"
},
{
"cve": "CVE-2021-4104",
"notes": [
{
"category": "details",
"text": "Log4j is an open-source Java logging library developed by the Apache Foundation which is widely used by both enterprise applications and cloud services. The recent Apache Log4j vulnerabilities are listed below and have ratings ranging from High to Critical. CVE-2021-44228 (Log4Shell), received a rating of Critical and can allow an attacker who can control log messages or log message parameters to execute arbitrary code loaded from LDAP servers and other JNDI related endpoints when message lookup substitution is enabled. Exploitation could allow for unauthenticated remote code execution (RCE) and possibly access to servers. Additional CVEs within the scope of this security notification:\nCVE-2021-44228\nCVE-2021-45046\nCVE-2021-45105\nCVE-2021-4104\nCVE-2021-44832\nFor more information, please visit the Apache logging services log4j security page https://logging.apache.org/log4j/2.x/security.html."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0013",
"CSAFPID-0017",
"CSAFPID-0020"
]
},
"title": "CVE-2021-4104"
},
{
"cve": "CVE-2021-44832",
"notes": [
{
"category": "description",
"text": "Log4j is an open-source Java logging library developed by the Apache Foundation which is widely used by both enterprise applications and cloud services. The recent Apache Log4j vulnerabilities are listed below and have ratings ranging from High to Critical. CVE-2021-44228 (Log4Shell), received a rating of Critical and can allow an attacker who can control log messages or log message parameters to execute arbitrary code loaded from LDAP servers and other JNDI related endpoints when message lookup substitution is enabled. Exploitation could allow for unauthenticated remote code execution (RCE) and possibly access to servers. Additional CVEs within the scope of this security notification:\nCVE-2021-44228\nCVE-2021-45046\nCVE-2021-45105\nCVE-2021-4104\nCVE-2021-44832\nFor more information, please visit the Apache logging services log4j security page https://logging.apache.org/log4j/2.x/security.html."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0013",
"CSAFPID-0017",
"CSAFPID-0020"
]
},
"title": "CVE-2021-44832"
}
]
}
SSA-397453
Vulnerability from csaf_siemens - Published: 2021-12-20 00:00 - Updated: 2021-12-20 00:00| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
TraceAlertServerPLUS
Siemens / TraceAlertServerPLUS
|
vers:all/* |
Mitigation
None Available
Mitigation
Mitigation
Mitigation
Mitigation
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
TraceAlertServerPLUS
Siemens / TraceAlertServerPLUS
|
vers:all/* |
Mitigation
None Available
Mitigation
Mitigation
Mitigation
Mitigation
|
{
"document": {
"category": "Siemens Security Advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited.",
"tlp": {
"label": "WHITE"
}
},
"notes": [
{
"category": "summary",
"text": "On 2021-12-09, a vulnerability in Apache Log4j (a logging library used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as \"Log4Shell\".\n\nOn 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities.\n\nOn 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution.\n\nSiemens Energy is preparing updates and recommends specific countermeasures for TraceAlertServerPLUS.",
"title": "Summary"
},
{
"category": "general",
"text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid\u0027s reliability can thus be minimized by virtue of the grid design.\n\nSiemens Energy strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens Energy strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment.\n\nAs a general security measure Siemens Energy strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-397453: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Energy TraceAlertServerPLUS - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf"
},
{
"category": "self",
"summary": "SSA-397453: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Energy TraceAlertServerPLUS - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-397453.txt"
},
{
"category": "self",
"summary": "SSA-397453: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Energy TraceAlertServerPLUS - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-397453.json"
}
],
"title": "SSA-397453: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Energy TraceAlertServerPLUS",
"tracking": {
"current_release_date": "2021-12-20T00:00:00Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-397453",
"initial_release_date": "2021-12-20T00:00:00Z",
"revision_history": [
{
"date": "2021-12-20T00:00:00Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "interim",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "TraceAlertServerPLUS",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "TraceAlertServerPLUS"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-44228",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Apache Log4j V2, versions \u003c 2.15.0 do not protect JNDI features (as used in configuration, log messages, and parameters) against attacker controlled LDAP and other JNDI related endpoints.\n\nAn attacker who can control log messages or log message parameters could execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"references": [
{
"summary": "CVE-2021-44228 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44228.json"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Open TraceAlertServerPLUS.exe with Zip tool to remove file JndiLookup.class in directory org/apache/logging/log4j/core/lookup/.\n\nThis measure mitigates both CVE-2021-44228 and CVE-2021-45046.",
"product_ids": [
"1"
]
},
{
"category": "none_available",
"details": "Currently no remediation is available",
"product_ids": [
"1"
]
},
{
"category": "mitigation",
"details": "Review the status of the defense in depth recommendations that apply to your specific deployment and align as needed. Especially the measures on the network layer to prevent accessibility from other network segments",
"product_ids": [
"1"
]
},
{
"category": "mitigation",
"details": "Restrict physical access to the local networks of the solution",
"product_ids": [
"1"
]
},
{
"category": "mitigation",
"details": "Ensure that TraceAlertServerPLUS does not run with elevated privileges",
"product_ids": [
"1"
]
},
{
"category": "mitigation",
"details": "Check file system permissions",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-44228"
},
{
"cve": "CVE-2021-45046",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "The fix to address CVE-2021-44228 was incomplete in certain non-default configurations, when the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, ${ctx:loginId}).\n\nThis could allow attackers with control over Thread Context Map (MDC) input data to craft malicious input data using a JNDI Lookup pattern, resulting in an information leak and remote code execution in some environments and local code execution in all environments.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"references": [
{
"summary": "CVE-2021-45046 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-45046.json"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Open TraceAlertServerPLUS.exe with Zip tool to remove file JndiLookup.class in directory org/apache/logging/log4j/core/lookup/.\n\nThis measure mitigates both CVE-2021-44228 and CVE-2021-45046.",
"product_ids": [
"1"
]
},
{
"category": "none_available",
"details": "Currently no remediation is available",
"product_ids": [
"1"
]
},
{
"category": "mitigation",
"details": "Review the status of the defense in depth recommendations that apply to your specific deployment and align as needed. Especially the measures on the network layer to prevent accessibility from other network segments",
"product_ids": [
"1"
]
},
{
"category": "mitigation",
"details": "Restrict physical access to the local networks of the solution",
"product_ids": [
"1"
]
},
{
"category": "mitigation",
"details": "Ensure that TraceAlertServerPLUS does not run with elevated privileges",
"product_ids": [
"1"
]
},
{
"category": "mitigation",
"details": "Check file system permissions",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-45046"
}
]
}
SSA-479842
Vulnerability from csaf_siemens - Published: 2021-12-21 00:00 - Updated: 2021-12-23 00:00| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Sensformer / Sensgear Platform (6BK1602-0AA12-0TP0)
Siemens / Sensformer / Sensgear Platform
|
6BK1602-0AA12-0TP0
|
< V2.7.0 |
Vendor Fix
|
|
Sensformer / Sensgear Platform (6BK1602-0AA22-0TP0)
Siemens / Sensformer / Sensgear Platform
|
6BK1602-0AA22-0TP0
|
< V2.7.0 |
Vendor Fix
|
|
Sensformer / Sensgear Platform (6BK1602-0AA32-0TP0)
Siemens / Sensformer / Sensgear Platform
|
6BK1602-0AA32-0TP0
|
< V2.7.0 |
Vendor Fix
|
|
Sensformer / Sensgear Platform (6BK1602-0AA42-0TP0)
Siemens / Sensformer / Sensgear Platform
|
6BK1602-0AA42-0TP0
|
< V2.7.0 |
Vendor Fix
|
|
Sensformer / Sensgear Platform (6BK1602-0AA52-0TP0)
Siemens / Sensformer / Sensgear Platform
|
6BK1602-0AA52-0TP0
|
< V2.7.0 |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Sensformer / Sensgear Platform (6BK1602-0AA12-0TP0)
Siemens / Sensformer / Sensgear Platform
|
6BK1602-0AA12-0TP0
|
< V2.7.0 |
Vendor Fix
|
|
Sensformer / Sensgear Platform (6BK1602-0AA22-0TP0)
Siemens / Sensformer / Sensgear Platform
|
6BK1602-0AA22-0TP0
|
< V2.7.0 |
Vendor Fix
|
|
Sensformer / Sensgear Platform (6BK1602-0AA32-0TP0)
Siemens / Sensformer / Sensgear Platform
|
6BK1602-0AA32-0TP0
|
< V2.7.0 |
Vendor Fix
|
|
Sensformer / Sensgear Platform (6BK1602-0AA42-0TP0)
Siemens / Sensformer / Sensgear Platform
|
6BK1602-0AA42-0TP0
|
< V2.7.0 |
Vendor Fix
|
|
Sensformer / Sensgear Platform (6BK1602-0AA52-0TP0)
Siemens / Sensformer / Sensgear Platform
|
6BK1602-0AA52-0TP0
|
< V2.7.0 |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Sensformer / Sensgear Platform (6BK1602-0AA12-0TP0)
Siemens / Sensformer / Sensgear Platform
|
6BK1602-0AA12-0TP0
|
< V2.7.0 |
Vendor Fix
|
|
Sensformer / Sensgear Platform (6BK1602-0AA22-0TP0)
Siemens / Sensformer / Sensgear Platform
|
6BK1602-0AA22-0TP0
|
< V2.7.0 |
Vendor Fix
|
|
Sensformer / Sensgear Platform (6BK1602-0AA32-0TP0)
Siemens / Sensformer / Sensgear Platform
|
6BK1602-0AA32-0TP0
|
< V2.7.0 |
Vendor Fix
|
|
Sensformer / Sensgear Platform (6BK1602-0AA42-0TP0)
Siemens / Sensformer / Sensgear Platform
|
6BK1602-0AA42-0TP0
|
< V2.7.0 |
Vendor Fix
|
|
Sensformer / Sensgear Platform (6BK1602-0AA52-0TP0)
Siemens / Sensformer / Sensgear Platform
|
6BK1602-0AA52-0TP0
|
< V2.7.0 |
Vendor Fix
|
{
"document": {
"category": "Siemens Security Advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited.",
"tlp": {
"label": "WHITE"
}
},
"notes": [
{
"category": "summary",
"text": "On 2021-12-09, a vulnerability in Apache Log4j (a logging tool used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as \"Log4Shell\".\n\nOn 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities.\n\nOn 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Furthermore, one additional denial of service vulnerability, CVE-2021-45105, was disclosed.\n\nThe Siemens Energy Sensformer / Sensgear cloud service was affected by these vulnerabilities and has remediated them. No user actions are necessary.",
"title": "Summary"
},
{
"category": "general",
"text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid\u0027s reliability can thus be minimized by virtue of the grid design.\n\nSiemens Energy strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens Energy strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment.\n\nAs a general security measure Siemens Energy strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-479842: Apache Log4j Vulnerabilities - Impact to Siemens Energy Sensformer / Sensgear (Platform, Basic and Advanced) - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf"
},
{
"category": "self",
"summary": "SSA-479842: Apache Log4j Vulnerabilities - Impact to Siemens Energy Sensformer / Sensgear (Platform, Basic and Advanced) - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-479842.txt"
},
{
"category": "self",
"summary": "SSA-479842: Apache Log4j Vulnerabilities - Impact to Siemens Energy Sensformer / Sensgear (Platform, Basic and Advanced) - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-479842.json"
}
],
"title": "SSA-479842: Apache Log4j Vulnerabilities - Impact to Siemens Energy Sensformer / Sensgear (Platform, Basic and Advanced)",
"tracking": {
"current_release_date": "2021-12-23T00:00:00Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-479842",
"initial_release_date": "2021-12-21T00:00:00Z",
"revision_history": [
{
"date": "2021-12-21T00:00:00Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2021-12-23T00:00:00Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Included Sensgear, clarified product name and summary"
}
],
"status": "interim",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V2.7.0",
"product": {
"name": "Sensformer / Sensgear Platform (6BK1602-0AA12-0TP0)",
"product_id": "1",
"product_identification_helper": {
"model_numbers": [
"6BK1602-0AA12-0TP0"
]
}
}
}
],
"category": "product_name",
"name": "Sensformer / Sensgear Platform"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V2.7.0",
"product": {
"name": "Sensformer / Sensgear Platform (6BK1602-0AA22-0TP0)",
"product_id": "2",
"product_identification_helper": {
"model_numbers": [
"6BK1602-0AA22-0TP0"
]
}
}
}
],
"category": "product_name",
"name": "Sensformer / Sensgear Platform"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V2.7.0",
"product": {
"name": "Sensformer / Sensgear Platform (6BK1602-0AA32-0TP0)",
"product_id": "3",
"product_identification_helper": {
"model_numbers": [
"6BK1602-0AA32-0TP0"
]
}
}
}
],
"category": "product_name",
"name": "Sensformer / Sensgear Platform"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V2.7.0",
"product": {
"name": "Sensformer / Sensgear Platform (6BK1602-0AA42-0TP0)",
"product_id": "4",
"product_identification_helper": {
"model_numbers": [
"6BK1602-0AA42-0TP0"
]
}
}
}
],
"category": "product_name",
"name": "Sensformer / Sensgear Platform"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V2.7.0",
"product": {
"name": "Sensformer / Sensgear Platform (6BK1602-0AA52-0TP0)",
"product_id": "5",
"product_identification_helper": {
"model_numbers": [
"6BK1602-0AA52-0TP0"
]
}
}
}
],
"category": "product_name",
"name": "Sensformer / Sensgear Platform"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-44228",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Apache Log4j V2, versions \u003c 2.15.0 do not protect JNDI features (as used in configuration, log messages, and parameters) against attacker controlled LDAP and other JNDI related endpoints.\n\nAn attacker who can control log messages or log message parameters could execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5"
]
},
"references": [
{
"summary": "CVE-2021-44228 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44228.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Vulnerabilities fixed on central cloud service between 2021-12-10 (CVE-2021-44228) and 2021-12-21 (CVE-2021-45105); no user actions necessary",
"product_ids": [
"1",
"2",
"3",
"4",
"5"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5"
]
}
],
"title": "CVE-2021-44228"
},
{
"cve": "CVE-2021-45046",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "The fix to address CVE-2021-44228 was incomplete in certain non-default configurations, when the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, ${ctx:loginId}).\n\nThis could allow attackers with control over Thread Context Map (MDC) input data to craft malicious input data using a JNDI Lookup pattern, resulting in an information leak and remote code execution in some environments and local code execution in all environments.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5"
]
},
"references": [
{
"summary": "CVE-2021-45046 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-45046.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Vulnerabilities fixed on central cloud service between 2021-12-10 (CVE-2021-44228) and 2021-12-21 (CVE-2021-45105); no user actions necessary",
"product_ids": [
"1",
"2",
"3",
"4",
"5"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5"
]
}
],
"title": "CVE-2021-45046"
},
{
"cve": "CVE-2021-45105",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"notes": [
{
"category": "summary",
"text": "Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups, when the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}).\n\nThis could allow attackers with control over Thread Context Map (MDC) input data to craft malicious input data that contains a recursive lookup, resulting in a denial of service condition.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5"
]
},
"references": [
{
"summary": "CVE-2021-45105 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-45105.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Vulnerabilities fixed on central cloud service between 2021-12-10 (CVE-2021-44228) and 2021-12-21 (CVE-2021-45105); no user actions necessary",
"product_ids": [
"1",
"2",
"3",
"4",
"5"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5"
]
}
],
"title": "CVE-2021-45105"
}
]
}
SSA-714170
Vulnerability from csaf_siemens - Published: 2021-12-16 00:00 - Updated: 2022-02-08 00:00| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
SPPA-T3000 SeS3000 Security Server (6DU7054-0..00-..A0)
Siemens / SPPA-T3000 SeS3000 Security Server (6DU7054-0..00-..A0)
|
vers:all/* |
Mitigation
None Available
Mitigation
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
SPPA-T3000 SeS3000 Security Server (6DU7054-0..00-..A0)
Siemens / SPPA-T3000 SeS3000 Security Server (6DU7054-0..00-..A0)
|
vers:all/* |
Mitigation
None Available
Mitigation
|
{
"document": {
"category": "Siemens Security Advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited.",
"tlp": {
"label": "WHITE"
}
},
"notes": [
{
"category": "summary",
"text": "On 2021-12-09, a vulnerability in Apache Log4j (a logging library used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as \"Log4Shell\".\n\nOn 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities.\n\nOn 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution.\n\nSiemens Energy is preparing updates and recommends specific countermeasures for SPPA-T3000.",
"title": "Summary"
},
{
"category": "general",
"text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid\u0027s reliability can thus be minimized by virtue of the grid design.\n\nSiemens Energy strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens Energy strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment.\n\nAs a general security measure Siemens Energy strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-714170: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to SPPA-T3000 - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf"
},
{
"category": "self",
"summary": "SSA-714170: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to SPPA-T3000 - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-714170.txt"
},
{
"category": "self",
"summary": "SSA-714170: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to SPPA-T3000 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-714170.json"
}
],
"title": "SSA-714170: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to SPPA-T3000",
"tracking": {
"current_release_date": "2022-02-08T00:00:00Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-714170",
"initial_release_date": "2021-12-16T00:00:00Z",
"revision_history": [
{
"date": "2021-12-16T00:00:00Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2022-02-08T00:00:00Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Revised severity of CVE-2021-45046; added specific document title provided in Siemens Energy customer portal"
}
],
"status": "interim",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SPPA-T3000 SeS3000 Security Server (6DU7054-0..00-..A0)",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "SPPA-T3000 SeS3000 Security Server (6DU7054-0..00-..A0)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-44228",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Apache Log4j V2, versions \u003c 2.15.0 do not protect JNDI features (as used in configuration, log messages, and parameters) against attacker controlled LDAP and other JNDI related endpoints.\n\nAn attacker who can control log messages or log message parameters could execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"references": [
{
"summary": "CVE-2021-44228 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44228.json"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Specific mitigations and how to apply are described in the SE Controls Security Announcement Incident 2021-01, available in the customer portal.\n\nhttps://cep.siemens-energy.com/cep/",
"product_ids": [
"1"
]
},
{
"category": "none_available",
"details": "Currently no remediation is available",
"product_ids": [
"1"
]
},
{
"category": "mitigation",
"details": "Ensure that SPPA-T3000 is set up according to the security concept defined in the SPPA-T3000 security manual",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-44228"
},
{
"cve": "CVE-2021-45046",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "The fix to address CVE-2021-44228 was incomplete in certain non-default configurations, when the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, ${ctx:loginId}).\n\nThis could allow attackers with control over Thread Context Map (MDC) input data to craft malicious input data using a JNDI Lookup pattern, resulting in an information leak and remote code execution in some environments and local code execution in all environments.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"references": [
{
"summary": "CVE-2021-45046 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-45046.json"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Specific mitigations and how to apply are described in the SE Controls Security Announcement Incident 2021-01, available in the customer portal.\n\nhttps://cep.siemens-energy.com/cep/",
"product_ids": [
"1"
]
},
{
"category": "none_available",
"details": "Currently no remediation is available",
"product_ids": [
"1"
]
},
{
"category": "mitigation",
"details": "Ensure that SPPA-T3000 is set up according to the security concept defined in the SPPA-T3000 security manual",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-45046"
}
]
}
SUSE-SU-2021:4096-1
Vulnerability from csaf_suse - Published: 2021-12-15 10:31 - Updated: 2021-12-15 10:31| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: HPE Helion OpenStack 8:storm-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: HPE Helion OpenStack 8:storm-nimbus-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: HPE Helion OpenStack 8:storm-supervisor-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: HPE Helion OpenStack 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud 8:storm-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud 8:storm-nimbus-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud 8:storm-supervisor-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud Crowbar 8:storm-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud Crowbar 8:storm-nimbus-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud Crowbar 8:storm-supervisor-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: HPE Helion OpenStack 8:storm-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: HPE Helion OpenStack 8:storm-nimbus-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: HPE Helion OpenStack 8:storm-supervisor-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: HPE Helion OpenStack 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud 8:storm-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud 8:storm-nimbus-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud 8:storm-supervisor-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud Crowbar 8:storm-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud Crowbar 8:storm-nimbus-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud Crowbar 8:storm-supervisor-1.2.3-3.8.2.x86_64 | — |
Vendor Fix
|
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for storm",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for storm fixes the following issues:\n\n- Remove JndiLookup from log4j 2.x jars during build to prevent \u0027log4shell\u0027 code injection. (bsc#1193641, bsc#1193611, CVE-2021-44228)\n- Remove JMSAppender from log4j 1.2.x jars during build to prevent attacks when JMS is enabled (bsc#1193641, bsc#1193662, CVE-2021-4104)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "HPE-Helion-OpenStack-8-2021-4096,SUSE-2021-4096,SUSE-OpenStack-Cloud-8-2021-4096,SUSE-OpenStack-Cloud-Crowbar-8-2021-4096",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2021_4096-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2021:4096-1",
"url": "https://www.suse.com/support/update/announcement/2021/suse-su-20214096-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2021:4096-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2021-December/009911.html"
},
{
"category": "self",
"summary": "SUSE Bug 1193611",
"url": "https://bugzilla.suse.com/1193611"
},
{
"category": "self",
"summary": "SUSE Bug 1193641",
"url": "https://bugzilla.suse.com/1193641"
},
{
"category": "self",
"summary": "SUSE Bug 1193662",
"url": "https://bugzilla.suse.com/1193662"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-4104 page",
"url": "https://www.suse.com/security/cve/CVE-2021-4104/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-44228 page",
"url": "https://www.suse.com/security/cve/CVE-2021-44228/"
}
],
"title": "Security update for storm",
"tracking": {
"current_release_date": "2021-12-15T10:31:48Z",
"generator": {
"date": "2021-12-15T10:31:48Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2021:4096-1",
"initial_release_date": "2021-12-15T10:31:48Z",
"revision_history": [
{
"date": "2021-12-15T10:31:48Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "storm-1.2.3-3.8.2.aarch64",
"product": {
"name": "storm-1.2.3-3.8.2.aarch64",
"product_id": "storm-1.2.3-3.8.2.aarch64"
}
},
{
"category": "product_version",
"name": "storm-doc-1.2.3-3.8.2.aarch64",
"product": {
"name": "storm-doc-1.2.3-3.8.2.aarch64",
"product_id": "storm-doc-1.2.3-3.8.2.aarch64"
}
},
{
"category": "product_version",
"name": "storm-logviewer-1.2.3-3.8.2.aarch64",
"product": {
"name": "storm-logviewer-1.2.3-3.8.2.aarch64",
"product_id": "storm-logviewer-1.2.3-3.8.2.aarch64"
}
},
{
"category": "product_version",
"name": "storm-nimbus-1.2.3-3.8.2.aarch64",
"product": {
"name": "storm-nimbus-1.2.3-3.8.2.aarch64",
"product_id": "storm-nimbus-1.2.3-3.8.2.aarch64"
}
},
{
"category": "product_version",
"name": "storm-pacemaker-1.2.3-3.8.2.aarch64",
"product": {
"name": "storm-pacemaker-1.2.3-3.8.2.aarch64",
"product_id": "storm-pacemaker-1.2.3-3.8.2.aarch64"
}
},
{
"category": "product_version",
"name": "storm-supervisor-1.2.3-3.8.2.aarch64",
"product": {
"name": "storm-supervisor-1.2.3-3.8.2.aarch64",
"product_id": "storm-supervisor-1.2.3-3.8.2.aarch64"
}
},
{
"category": "product_version",
"name": "storm-ui-1.2.3-3.8.2.aarch64",
"product": {
"name": "storm-ui-1.2.3-3.8.2.aarch64",
"product_id": "storm-ui-1.2.3-3.8.2.aarch64"
}
},
{
"category": "product_version",
"name": "storm-zookeeper-1.2.3-3.8.2.aarch64",
"product": {
"name": "storm-zookeeper-1.2.3-3.8.2.aarch64",
"product_id": "storm-zookeeper-1.2.3-3.8.2.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"product": {
"name": "venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"product_id": "venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch"
}
},
{
"category": "product_version",
"name": "storm-kit-1.2.3-3.10.1.noarch",
"product": {
"name": "storm-kit-1.2.3-3.10.1.noarch",
"product_id": "storm-kit-1.2.3-3.10.1.noarch"
}
},
{
"category": "product_version",
"name": "venv-openstack-monasca-aarch64-2.2.2~dev1-11.32.1.noarch",
"product": {
"name": "venv-openstack-monasca-aarch64-2.2.2~dev1-11.32.1.noarch",
"product_id": "venv-openstack-monasca-aarch64-2.2.2~dev1-11.32.1.noarch"
}
},
{
"category": "product_version",
"name": "venv-openstack-monasca-ppc64le-2.2.2~dev1-11.32.1.noarch",
"product": {
"name": "venv-openstack-monasca-ppc64le-2.2.2~dev1-11.32.1.noarch",
"product_id": "venv-openstack-monasca-ppc64le-2.2.2~dev1-11.32.1.noarch"
}
},
{
"category": "product_version",
"name": "venv-openstack-monasca-s390x-2.2.2~dev1-11.32.1.noarch",
"product": {
"name": "venv-openstack-monasca-s390x-2.2.2~dev1-11.32.1.noarch",
"product_id": "venv-openstack-monasca-s390x-2.2.2~dev1-11.32.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "storm-1.2.3-3.8.2.ppc64le",
"product": {
"name": "storm-1.2.3-3.8.2.ppc64le",
"product_id": "storm-1.2.3-3.8.2.ppc64le"
}
},
{
"category": "product_version",
"name": "storm-doc-1.2.3-3.8.2.ppc64le",
"product": {
"name": "storm-doc-1.2.3-3.8.2.ppc64le",
"product_id": "storm-doc-1.2.3-3.8.2.ppc64le"
}
},
{
"category": "product_version",
"name": "storm-logviewer-1.2.3-3.8.2.ppc64le",
"product": {
"name": "storm-logviewer-1.2.3-3.8.2.ppc64le",
"product_id": "storm-logviewer-1.2.3-3.8.2.ppc64le"
}
},
{
"category": "product_version",
"name": "storm-nimbus-1.2.3-3.8.2.ppc64le",
"product": {
"name": "storm-nimbus-1.2.3-3.8.2.ppc64le",
"product_id": "storm-nimbus-1.2.3-3.8.2.ppc64le"
}
},
{
"category": "product_version",
"name": "storm-pacemaker-1.2.3-3.8.2.ppc64le",
"product": {
"name": "storm-pacemaker-1.2.3-3.8.2.ppc64le",
"product_id": "storm-pacemaker-1.2.3-3.8.2.ppc64le"
}
},
{
"category": "product_version",
"name": "storm-supervisor-1.2.3-3.8.2.ppc64le",
"product": {
"name": "storm-supervisor-1.2.3-3.8.2.ppc64le",
"product_id": "storm-supervisor-1.2.3-3.8.2.ppc64le"
}
},
{
"category": "product_version",
"name": "storm-ui-1.2.3-3.8.2.ppc64le",
"product": {
"name": "storm-ui-1.2.3-3.8.2.ppc64le",
"product_id": "storm-ui-1.2.3-3.8.2.ppc64le"
}
},
{
"category": "product_version",
"name": "storm-zookeeper-1.2.3-3.8.2.ppc64le",
"product": {
"name": "storm-zookeeper-1.2.3-3.8.2.ppc64le",
"product_id": "storm-zookeeper-1.2.3-3.8.2.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "storm-1.2.3-3.8.2.x86_64",
"product": {
"name": "storm-1.2.3-3.8.2.x86_64",
"product_id": "storm-1.2.3-3.8.2.x86_64"
}
},
{
"category": "product_version",
"name": "storm-nimbus-1.2.3-3.8.2.x86_64",
"product": {
"name": "storm-nimbus-1.2.3-3.8.2.x86_64",
"product_id": "storm-nimbus-1.2.3-3.8.2.x86_64"
}
},
{
"category": "product_version",
"name": "storm-supervisor-1.2.3-3.8.2.x86_64",
"product": {
"name": "storm-supervisor-1.2.3-3.8.2.x86_64",
"product_id": "storm-supervisor-1.2.3-3.8.2.x86_64"
}
},
{
"category": "product_version",
"name": "storm-doc-1.2.3-3.8.2.x86_64",
"product": {
"name": "storm-doc-1.2.3-3.8.2.x86_64",
"product_id": "storm-doc-1.2.3-3.8.2.x86_64"
}
},
{
"category": "product_version",
"name": "storm-logviewer-1.2.3-3.8.2.x86_64",
"product": {
"name": "storm-logviewer-1.2.3-3.8.2.x86_64",
"product_id": "storm-logviewer-1.2.3-3.8.2.x86_64"
}
},
{
"category": "product_version",
"name": "storm-pacemaker-1.2.3-3.8.2.x86_64",
"product": {
"name": "storm-pacemaker-1.2.3-3.8.2.x86_64",
"product_id": "storm-pacemaker-1.2.3-3.8.2.x86_64"
}
},
{
"category": "product_version",
"name": "storm-ui-1.2.3-3.8.2.x86_64",
"product": {
"name": "storm-ui-1.2.3-3.8.2.x86_64",
"product_id": "storm-ui-1.2.3-3.8.2.x86_64"
}
},
{
"category": "product_version",
"name": "storm-zookeeper-1.2.3-3.8.2.x86_64",
"product": {
"name": "storm-zookeeper-1.2.3-3.8.2.x86_64",
"product_id": "storm-zookeeper-1.2.3-3.8.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "HPE Helion OpenStack 8",
"product": {
"name": "HPE Helion OpenStack 8",
"product_id": "HPE Helion OpenStack 8",
"product_identification_helper": {
"cpe": "cpe:/o:suse:hpe-helion-openstack:8"
}
}
},
{
"category": "product_name",
"name": "SUSE OpenStack Cloud 8",
"product": {
"name": "SUSE OpenStack Cloud 8",
"product_id": "SUSE OpenStack Cloud 8",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud:8"
}
}
},
{
"category": "product_name",
"name": "SUSE OpenStack Cloud Crowbar 8",
"product": {
"name": "SUSE OpenStack Cloud Crowbar 8",
"product_id": "SUSE OpenStack Cloud Crowbar 8",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud-crowbar:8"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "storm-1.2.3-3.8.2.x86_64 as component of HPE Helion OpenStack 8",
"product_id": "HPE Helion OpenStack 8:storm-1.2.3-3.8.2.x86_64"
},
"product_reference": "storm-1.2.3-3.8.2.x86_64",
"relates_to_product_reference": "HPE Helion OpenStack 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storm-nimbus-1.2.3-3.8.2.x86_64 as component of HPE Helion OpenStack 8",
"product_id": "HPE Helion OpenStack 8:storm-nimbus-1.2.3-3.8.2.x86_64"
},
"product_reference": "storm-nimbus-1.2.3-3.8.2.x86_64",
"relates_to_product_reference": "HPE Helion OpenStack 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storm-supervisor-1.2.3-3.8.2.x86_64 as component of HPE Helion OpenStack 8",
"product_id": "HPE Helion OpenStack 8:storm-supervisor-1.2.3-3.8.2.x86_64"
},
"product_reference": "storm-supervisor-1.2.3-3.8.2.x86_64",
"relates_to_product_reference": "HPE Helion OpenStack 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch as component of HPE Helion OpenStack 8",
"product_id": "HPE Helion OpenStack 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch"
},
"product_reference": "venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"relates_to_product_reference": "HPE Helion OpenStack 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storm-1.2.3-3.8.2.x86_64 as component of SUSE OpenStack Cloud 8",
"product_id": "SUSE OpenStack Cloud 8:storm-1.2.3-3.8.2.x86_64"
},
"product_reference": "storm-1.2.3-3.8.2.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storm-nimbus-1.2.3-3.8.2.x86_64 as component of SUSE OpenStack Cloud 8",
"product_id": "SUSE OpenStack Cloud 8:storm-nimbus-1.2.3-3.8.2.x86_64"
},
"product_reference": "storm-nimbus-1.2.3-3.8.2.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storm-supervisor-1.2.3-3.8.2.x86_64 as component of SUSE OpenStack Cloud 8",
"product_id": "SUSE OpenStack Cloud 8:storm-supervisor-1.2.3-3.8.2.x86_64"
},
"product_reference": "storm-supervisor-1.2.3-3.8.2.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch as component of SUSE OpenStack Cloud 8",
"product_id": "SUSE OpenStack Cloud 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch"
},
"product_reference": "venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"relates_to_product_reference": "SUSE OpenStack Cloud 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storm-1.2.3-3.8.2.x86_64 as component of SUSE OpenStack Cloud Crowbar 8",
"product_id": "SUSE OpenStack Cloud Crowbar 8:storm-1.2.3-3.8.2.x86_64"
},
"product_reference": "storm-1.2.3-3.8.2.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storm-nimbus-1.2.3-3.8.2.x86_64 as component of SUSE OpenStack Cloud Crowbar 8",
"product_id": "SUSE OpenStack Cloud Crowbar 8:storm-nimbus-1.2.3-3.8.2.x86_64"
},
"product_reference": "storm-nimbus-1.2.3-3.8.2.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storm-supervisor-1.2.3-3.8.2.x86_64 as component of SUSE OpenStack Cloud Crowbar 8",
"product_id": "SUSE OpenStack Cloud Crowbar 8:storm-supervisor-1.2.3-3.8.2.x86_64"
},
"product_reference": "storm-supervisor-1.2.3-3.8.2.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 8"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-4104",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-4104"
}
],
"notes": [
{
"category": "general",
"text": "JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"HPE Helion OpenStack 8:storm-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:storm-supervisor-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"SUSE OpenStack Cloud 8:storm-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:storm-supervisor-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"SUSE OpenStack Cloud Crowbar 8:storm-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud Crowbar 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud Crowbar 8:storm-supervisor-1.2.3-3.8.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-4104",
"url": "https://www.suse.com/security/cve/CVE-2021-4104"
},
{
"category": "external",
"summary": "SUSE Bug 1193662 for CVE-2021-4104",
"url": "https://bugzilla.suse.com/1193662"
},
{
"category": "external",
"summary": "SUSE Bug 1193978 for CVE-2021-4104",
"url": "https://bugzilla.suse.com/1193978"
},
{
"category": "external",
"summary": "SUSE Bug 1194016 for CVE-2021-4104",
"url": "https://bugzilla.suse.com/1194016"
},
{
"category": "external",
"summary": "SUSE Bug 1194842 for CVE-2021-4104",
"url": "https://bugzilla.suse.com/1194842"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"HPE Helion OpenStack 8:storm-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:storm-supervisor-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"SUSE OpenStack Cloud 8:storm-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:storm-supervisor-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"SUSE OpenStack Cloud Crowbar 8:storm-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud Crowbar 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud Crowbar 8:storm-supervisor-1.2.3-3.8.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"HPE Helion OpenStack 8:storm-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:storm-supervisor-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"SUSE OpenStack Cloud 8:storm-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:storm-supervisor-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"SUSE OpenStack Cloud Crowbar 8:storm-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud Crowbar 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud Crowbar 8:storm-supervisor-1.2.3-3.8.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-12-15T10:31:48Z",
"details": "moderate"
}
],
"title": "CVE-2021-4104"
},
{
"cve": "CVE-2021-44228",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-44228"
}
],
"notes": [
{
"category": "general",
"text": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"HPE Helion OpenStack 8:storm-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:storm-supervisor-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"SUSE OpenStack Cloud 8:storm-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:storm-supervisor-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"SUSE OpenStack Cloud Crowbar 8:storm-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud Crowbar 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud Crowbar 8:storm-supervisor-1.2.3-3.8.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-44228",
"url": "https://www.suse.com/security/cve/CVE-2021-44228"
},
{
"category": "external",
"summary": "SUSE Bug 1193611 for CVE-2021-44228",
"url": "https://bugzilla.suse.com/1193611"
},
{
"category": "external",
"summary": "SUSE Bug 1193662 for CVE-2021-44228",
"url": "https://bugzilla.suse.com/1193662"
},
{
"category": "external",
"summary": "SUSE Bug 1193743 for CVE-2021-44228",
"url": "https://bugzilla.suse.com/1193743"
},
{
"category": "external",
"summary": "SUSE Bug 1193795 for CVE-2021-44228",
"url": "https://bugzilla.suse.com/1193795"
},
{
"category": "external",
"summary": "SUSE Bug 1194016 for CVE-2021-44228",
"url": "https://bugzilla.suse.com/1194016"
},
{
"category": "external",
"summary": "SUSE Bug 1194123 for CVE-2021-44228",
"url": "https://bugzilla.suse.com/1194123"
},
{
"category": "external",
"summary": "SUSE Bug 1202994 for CVE-2021-44228",
"url": "https://bugzilla.suse.com/1202994"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"HPE Helion OpenStack 8:storm-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:storm-supervisor-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"SUSE OpenStack Cloud 8:storm-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:storm-supervisor-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"SUSE OpenStack Cloud Crowbar 8:storm-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud Crowbar 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud Crowbar 8:storm-supervisor-1.2.3-3.8.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"HPE Helion OpenStack 8:storm-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:storm-supervisor-1.2.3-3.8.2.x86_64",
"HPE Helion OpenStack 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"SUSE OpenStack Cloud 8:storm-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:storm-supervisor-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1.noarch",
"SUSE OpenStack Cloud Crowbar 8:storm-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud Crowbar 8:storm-nimbus-1.2.3-3.8.2.x86_64",
"SUSE OpenStack Cloud Crowbar 8:storm-supervisor-1.2.3-3.8.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-12-15T10:31:48Z",
"details": "critical"
}
],
"title": "CVE-2021-44228"
}
]
}
SUSE-SU-2021:4097-1
Vulnerability from csaf_suse - Published: 2021-12-15 10:32 - Updated: 2021-12-15 10:32| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE OpenStack Cloud 9:storm-1.2.3-3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud 9:storm-nimbus-1.2.3-3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud 9:storm-supervisor-1.2.3-3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud 9:venv-openstack-monasca-x86_64-2.7.1~dev10-3.25.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud Crowbar 9:storm-1.2.3-3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud Crowbar 9:storm-nimbus-1.2.3-3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud Crowbar 9:storm-supervisor-1.2.3-3.5.1.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE OpenStack Cloud 9:storm-1.2.3-3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud 9:storm-nimbus-1.2.3-3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud 9:storm-supervisor-1.2.3-3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud 9:venv-openstack-monasca-x86_64-2.7.1~dev10-3.25.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud Crowbar 9:storm-1.2.3-3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud Crowbar 9:storm-nimbus-1.2.3-3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE OpenStack Cloud Crowbar 9:storm-supervisor-1.2.3-3.5.1.x86_64 | — |
Vendor Fix
|
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for storm-kit",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for storm-kit fixes the following issues:\n\n- Remove JndiLookup from log4j 2.x jars during build to\n prevent \u0027log4shell\u0027 code injection. (bsc#1193641, bsc#1193611, CVE-2021-44228)\n- Remove JMSAppender from log4j 1.2.x jars during build to prevent attacks when JMS is enabled (bsc#1193641, bsc#1193662, CVE-2021-4104)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2021-4097,SUSE-OpenStack-Cloud-9-2021-4097,SUSE-OpenStack-Cloud-Crowbar-9-2021-4097",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2021_4097-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2021:4097-1",
"url": "https://www.suse.com/support/update/announcement/2021/suse-su-20214097-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2021:4097-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2021-December/009912.html"
},
{
"category": "self",
"summary": "SUSE Bug 1193611",
"url": "https://bugzilla.suse.com/1193611"
},
{
"category": "self",
"summary": "SUSE Bug 1193641",
"url": "https://bugzilla.suse.com/1193641"
},
{
"category": "self",
"summary": "SUSE Bug 1193662",
"url": "https://bugzilla.suse.com/1193662"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-4104 page",
"url": "https://www.suse.com/security/cve/CVE-2021-4104/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-44228 page",
"url": "https://www.suse.com/security/cve/CVE-2021-44228/"
}
],
"title": "Security update for storm-kit",
"tracking": {
"current_release_date": "2021-12-15T10:32:17Z",
"generator": {
"date": "2021-12-15T10:32:17Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2021:4097-1",
"initial_release_date": "2021-12-15T10:32:17Z",
"revision_history": [
{
"date": "2021-12-15T10:32:17Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "storm-1.2.3-3.5.1.aarch64",
"product": {
"name": "storm-1.2.3-3.5.1.aarch64",
"product_id": "storm-1.2.3-3.5.1.aarch64"
}
},
{
"category": "product_version",
"name": "storm-doc-1.2.3-3.5.1.aarch64",
"product": {
"name": "storm-doc-1.2.3-3.5.1.aarch64",
"product_id": "storm-doc-1.2.3-3.5.1.aarch64"
}
},
{
"category": "product_version",
"name": "storm-logviewer-1.2.3-3.5.1.aarch64",
"product": {
"name": "storm-logviewer-1.2.3-3.5.1.aarch64",
"product_id": "storm-logviewer-1.2.3-3.5.1.aarch64"
}
},
{
"category": "product_version",
"name": "storm-nimbus-1.2.3-3.5.1.aarch64",
"product": {
"name": "storm-nimbus-1.2.3-3.5.1.aarch64",
"product_id": "storm-nimbus-1.2.3-3.5.1.aarch64"
}
},
{
"category": "product_version",
"name": "storm-pacemaker-1.2.3-3.5.1.aarch64",
"product": {
"name": "storm-pacemaker-1.2.3-3.5.1.aarch64",
"product_id": "storm-pacemaker-1.2.3-3.5.1.aarch64"
}
},
{
"category": "product_version",
"name": "storm-supervisor-1.2.3-3.5.1.aarch64",
"product": {
"name": "storm-supervisor-1.2.3-3.5.1.aarch64",
"product_id": "storm-supervisor-1.2.3-3.5.1.aarch64"
}
},
{
"category": "product_version",
"name": "storm-ui-1.2.3-3.5.1.aarch64",
"product": {
"name": "storm-ui-1.2.3-3.5.1.aarch64",
"product_id": "storm-ui-1.2.3-3.5.1.aarch64"
}
},
{
"category": "product_version",
"name": "storm-zookeeper-1.2.3-3.5.1.aarch64",
"product": {
"name": "storm-zookeeper-1.2.3-3.5.1.aarch64",
"product_id": "storm-zookeeper-1.2.3-3.5.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "storm-kit-1.2.3-3.6.2.noarch",
"product": {
"name": "storm-kit-1.2.3-3.6.2.noarch",
"product_id": "storm-kit-1.2.3-3.6.2.noarch"
}
},
{
"category": "product_version",
"name": "venv-openstack-monasca-aarch64-2.7.1~dev10-3.25.1.noarch",
"product": {
"name": "venv-openstack-monasca-aarch64-2.7.1~dev10-3.25.1.noarch",
"product_id": "venv-openstack-monasca-aarch64-2.7.1~dev10-3.25.1.noarch"
}
},
{
"category": "product_version",
"name": "venv-openstack-monasca-ppc64le-2.7.1~dev10-3.25.1.noarch",
"product": {
"name": "venv-openstack-monasca-ppc64le-2.7.1~dev10-3.25.1.noarch",
"product_id": "venv-openstack-monasca-ppc64le-2.7.1~dev10-3.25.1.noarch"
}
},
{
"category": "product_version",
"name": "venv-openstack-monasca-s390x-2.7.1~dev10-3.25.1.noarch",
"product": {
"name": "venv-openstack-monasca-s390x-2.7.1~dev10-3.25.1.noarch",
"product_id": "venv-openstack-monasca-s390x-2.7.1~dev10-3.25.1.noarch"
}
},
{
"category": "product_version",
"name": "venv-openstack-monasca-x86_64-2.7.1~dev10-3.25.1.noarch",
"product": {
"name": "venv-openstack-monasca-x86_64-2.7.1~dev10-3.25.1.noarch",
"product_id": "venv-openstack-monasca-x86_64-2.7.1~dev10-3.25.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "storm-1.2.3-3.5.1.ppc64le",
"product": {
"name": "storm-1.2.3-3.5.1.ppc64le",
"product_id": "storm-1.2.3-3.5.1.ppc64le"
}
},
{
"category": "product_version",
"name": "storm-doc-1.2.3-3.5.1.ppc64le",
"product": {
"name": "storm-doc-1.2.3-3.5.1.ppc64le",
"product_id": "storm-doc-1.2.3-3.5.1.ppc64le"
}
},
{
"category": "product_version",
"name": "storm-logviewer-1.2.3-3.5.1.ppc64le",
"product": {
"name": "storm-logviewer-1.2.3-3.5.1.ppc64le",
"product_id": "storm-logviewer-1.2.3-3.5.1.ppc64le"
}
},
{
"category": "product_version",
"name": "storm-nimbus-1.2.3-3.5.1.ppc64le",
"product": {
"name": "storm-nimbus-1.2.3-3.5.1.ppc64le",
"product_id": "storm-nimbus-1.2.3-3.5.1.ppc64le"
}
},
{
"category": "product_version",
"name": "storm-pacemaker-1.2.3-3.5.1.ppc64le",
"product": {
"name": "storm-pacemaker-1.2.3-3.5.1.ppc64le",
"product_id": "storm-pacemaker-1.2.3-3.5.1.ppc64le"
}
},
{
"category": "product_version",
"name": "storm-supervisor-1.2.3-3.5.1.ppc64le",
"product": {
"name": "storm-supervisor-1.2.3-3.5.1.ppc64le",
"product_id": "storm-supervisor-1.2.3-3.5.1.ppc64le"
}
},
{
"category": "product_version",
"name": "storm-ui-1.2.3-3.5.1.ppc64le",
"product": {
"name": "storm-ui-1.2.3-3.5.1.ppc64le",
"product_id": "storm-ui-1.2.3-3.5.1.ppc64le"
}
},
{
"category": "product_version",
"name": "storm-zookeeper-1.2.3-3.5.1.ppc64le",
"product": {
"name": "storm-zookeeper-1.2.3-3.5.1.ppc64le",
"product_id": "storm-zookeeper-1.2.3-3.5.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "storm-1.2.3-3.5.1.x86_64",
"product": {
"name": "storm-1.2.3-3.5.1.x86_64",
"product_id": "storm-1.2.3-3.5.1.x86_64"
}
},
{
"category": "product_version",
"name": "storm-doc-1.2.3-3.5.1.x86_64",
"product": {
"name": "storm-doc-1.2.3-3.5.1.x86_64",
"product_id": "storm-doc-1.2.3-3.5.1.x86_64"
}
},
{
"category": "product_version",
"name": "storm-logviewer-1.2.3-3.5.1.x86_64",
"product": {
"name": "storm-logviewer-1.2.3-3.5.1.x86_64",
"product_id": "storm-logviewer-1.2.3-3.5.1.x86_64"
}
},
{
"category": "product_version",
"name": "storm-nimbus-1.2.3-3.5.1.x86_64",
"product": {
"name": "storm-nimbus-1.2.3-3.5.1.x86_64",
"product_id": "storm-nimbus-1.2.3-3.5.1.x86_64"
}
},
{
"category": "product_version",
"name": "storm-pacemaker-1.2.3-3.5.1.x86_64",
"product": {
"name": "storm-pacemaker-1.2.3-3.5.1.x86_64",
"product_id": "storm-pacemaker-1.2.3-3.5.1.x86_64"
}
},
{
"category": "product_version",
"name": "storm-supervisor-1.2.3-3.5.1.x86_64",
"product": {
"name": "storm-supervisor-1.2.3-3.5.1.x86_64",
"product_id": "storm-supervisor-1.2.3-3.5.1.x86_64"
}
},
{
"category": "product_version",
"name": "storm-ui-1.2.3-3.5.1.x86_64",
"product": {
"name": "storm-ui-1.2.3-3.5.1.x86_64",
"product_id": "storm-ui-1.2.3-3.5.1.x86_64"
}
},
{
"category": "product_version",
"name": "storm-zookeeper-1.2.3-3.5.1.x86_64",
"product": {
"name": "storm-zookeeper-1.2.3-3.5.1.x86_64",
"product_id": "storm-zookeeper-1.2.3-3.5.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE OpenStack Cloud 9",
"product": {
"name": "SUSE OpenStack Cloud 9",
"product_id": "SUSE OpenStack Cloud 9",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud:9"
}
}
},
{
"category": "product_name",
"name": "SUSE OpenStack Cloud Crowbar 9",
"product": {
"name": "SUSE OpenStack Cloud Crowbar 9",
"product_id": "SUSE OpenStack Cloud Crowbar 9",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud-crowbar:9"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "storm-1.2.3-3.5.1.x86_64 as component of SUSE OpenStack Cloud 9",
"product_id": "SUSE OpenStack Cloud 9:storm-1.2.3-3.5.1.x86_64"
},
"product_reference": "storm-1.2.3-3.5.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storm-nimbus-1.2.3-3.5.1.x86_64 as component of SUSE OpenStack Cloud 9",
"product_id": "SUSE OpenStack Cloud 9:storm-nimbus-1.2.3-3.5.1.x86_64"
},
"product_reference": "storm-nimbus-1.2.3-3.5.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storm-supervisor-1.2.3-3.5.1.x86_64 as component of SUSE OpenStack Cloud 9",
"product_id": "SUSE OpenStack Cloud 9:storm-supervisor-1.2.3-3.5.1.x86_64"
},
"product_reference": "storm-supervisor-1.2.3-3.5.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "venv-openstack-monasca-x86_64-2.7.1~dev10-3.25.1.noarch as component of SUSE OpenStack Cloud 9",
"product_id": "SUSE OpenStack Cloud 9:venv-openstack-monasca-x86_64-2.7.1~dev10-3.25.1.noarch"
},
"product_reference": "venv-openstack-monasca-x86_64-2.7.1~dev10-3.25.1.noarch",
"relates_to_product_reference": "SUSE OpenStack Cloud 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storm-1.2.3-3.5.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 9",
"product_id": "SUSE OpenStack Cloud Crowbar 9:storm-1.2.3-3.5.1.x86_64"
},
"product_reference": "storm-1.2.3-3.5.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storm-nimbus-1.2.3-3.5.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 9",
"product_id": "SUSE OpenStack Cloud Crowbar 9:storm-nimbus-1.2.3-3.5.1.x86_64"
},
"product_reference": "storm-nimbus-1.2.3-3.5.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storm-supervisor-1.2.3-3.5.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 9",
"product_id": "SUSE OpenStack Cloud Crowbar 9:storm-supervisor-1.2.3-3.5.1.x86_64"
},
"product_reference": "storm-supervisor-1.2.3-3.5.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 9"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-4104",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-4104"
}
],
"notes": [
{
"category": "general",
"text": "JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 9:storm-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:storm-nimbus-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:storm-supervisor-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:venv-openstack-monasca-x86_64-2.7.1~dev10-3.25.1.noarch",
"SUSE OpenStack Cloud Crowbar 9:storm-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:storm-nimbus-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:storm-supervisor-1.2.3-3.5.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-4104",
"url": "https://www.suse.com/security/cve/CVE-2021-4104"
},
{
"category": "external",
"summary": "SUSE Bug 1193662 for CVE-2021-4104",
"url": "https://bugzilla.suse.com/1193662"
},
{
"category": "external",
"summary": "SUSE Bug 1193978 for CVE-2021-4104",
"url": "https://bugzilla.suse.com/1193978"
},
{
"category": "external",
"summary": "SUSE Bug 1194016 for CVE-2021-4104",
"url": "https://bugzilla.suse.com/1194016"
},
{
"category": "external",
"summary": "SUSE Bug 1194842 for CVE-2021-4104",
"url": "https://bugzilla.suse.com/1194842"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 9:storm-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:storm-nimbus-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:storm-supervisor-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:venv-openstack-monasca-x86_64-2.7.1~dev10-3.25.1.noarch",
"SUSE OpenStack Cloud Crowbar 9:storm-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:storm-nimbus-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:storm-supervisor-1.2.3-3.5.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE OpenStack Cloud 9:storm-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:storm-nimbus-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:storm-supervisor-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:venv-openstack-monasca-x86_64-2.7.1~dev10-3.25.1.noarch",
"SUSE OpenStack Cloud Crowbar 9:storm-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:storm-nimbus-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:storm-supervisor-1.2.3-3.5.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-12-15T10:32:17Z",
"details": "moderate"
}
],
"title": "CVE-2021-4104"
},
{
"cve": "CVE-2021-44228",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-44228"
}
],
"notes": [
{
"category": "general",
"text": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 9:storm-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:storm-nimbus-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:storm-supervisor-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:venv-openstack-monasca-x86_64-2.7.1~dev10-3.25.1.noarch",
"SUSE OpenStack Cloud Crowbar 9:storm-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:storm-nimbus-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:storm-supervisor-1.2.3-3.5.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-44228",
"url": "https://www.suse.com/security/cve/CVE-2021-44228"
},
{
"category": "external",
"summary": "SUSE Bug 1193611 for CVE-2021-44228",
"url": "https://bugzilla.suse.com/1193611"
},
{
"category": "external",
"summary": "SUSE Bug 1193662 for CVE-2021-44228",
"url": "https://bugzilla.suse.com/1193662"
},
{
"category": "external",
"summary": "SUSE Bug 1193743 for CVE-2021-44228",
"url": "https://bugzilla.suse.com/1193743"
},
{
"category": "external",
"summary": "SUSE Bug 1193795 for CVE-2021-44228",
"url": "https://bugzilla.suse.com/1193795"
},
{
"category": "external",
"summary": "SUSE Bug 1194016 for CVE-2021-44228",
"url": "https://bugzilla.suse.com/1194016"
},
{
"category": "external",
"summary": "SUSE Bug 1194123 for CVE-2021-44228",
"url": "https://bugzilla.suse.com/1194123"
},
{
"category": "external",
"summary": "SUSE Bug 1202994 for CVE-2021-44228",
"url": "https://bugzilla.suse.com/1202994"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 9:storm-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:storm-nimbus-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:storm-supervisor-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:venv-openstack-monasca-x86_64-2.7.1~dev10-3.25.1.noarch",
"SUSE OpenStack Cloud Crowbar 9:storm-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:storm-nimbus-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:storm-supervisor-1.2.3-3.5.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE OpenStack Cloud 9:storm-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:storm-nimbus-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:storm-supervisor-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud 9:venv-openstack-monasca-x86_64-2.7.1~dev10-3.25.1.noarch",
"SUSE OpenStack Cloud Crowbar 9:storm-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:storm-nimbus-1.2.3-3.5.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:storm-supervisor-1.2.3-3.5.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-12-15T10:32:17Z",
"details": "critical"
}
],
"title": "CVE-2021-44228"
}
]
}
VAR-202112-0566
Vulnerability from variot - Updated: 2024-07-23 21:58Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. Apache Log4j allows insecure JNDI lookups that could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the vulnerable Java application using Log4j.CVE-2021-4104 Affected CVE-2021-44228 Affected CVE-2021-45046 AffectedCVE-2021-4104 Affected CVE-2021-44228 Affected CVE-2021-45046 Affected. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
===================================================================== Red Hat Security Advisory
Synopsis: Critical: Red Hat Data Grid 8.2.2 security update Advisory ID: RHSA-2021:5132-01 Product: Red Hat JBoss Data Grid Advisory URL: https://access.redhat.com/errata/RHSA-2021:5132 Issue date: 2021-12-14 CVE Names: CVE-2021-44228 =====================================================================
- Summary:
An update for Red Hat Data Grid is now available.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Description:
Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale.
Data Grid 8.2.2 replaces Data Grid 8.2.1 and includes bug fixes and enhancements. Find out more about Data Grid 8.2.2 in the Release Notes [3].
Security Fix(es):
- log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value (CVE-2021-44228)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Solution:
To install this update, do the following:
- Download the Data Grid 8.2.2 server patch from the customer portal[²].
- Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.
- Install the Data Grid 8.2.2 server patch. Refer to the 8.2.2 Release Notes[³] for patching instructions.
-
Restart Data Grid to ensure the changes take effect.
-
Bugs fixed (https://bugzilla.redhat.com/):
2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value
- References:
https://access.redhat.com/security/cve/CVE-2021-44228 https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/jbossnetwork/restricted/softwareDetail.html?softwareId=70381&product=data.grid&version=8.2&downloadType=patches https://access.redhat.com/documentation/en-us/red_hat_data_grid/8.2/html-single/red_hat_data_grid_8.2_release_notes/index https://access.redhat.com/security/vulnerabilities/RHSB-2021-009
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBYblI0NzjgjWX9erEAQj7mw//TtZnFmrLI6Ts7uC19MnLA/vVPXT1i2Qz R1CZ4T7QCZkiJCNXvwYHj7iQgOm5o/seXRE38qGtJWqiyrZMGHVQnDl1Vuhm31jg 6lxhpjn0kKKZanznosCxF3U2ovLhrEx+5in4piNiyV6CKkkgBV7UvESGWlIKiumq 1r79DAQ7WdYPoOk+m+b5p/okFJXyD0FcEbrqZcgJQCmR9zyJ6DGAy4N9+cgEgGaC QoVZaXa+pUEVjiAOAg0XNcb+GyYSMFwkPUR14NI0V2OHIo97aBg9AG1HrOj3QmSG 5LR/8zWQbfSbtTIzR67gBGF8F8nvnEeBARYje97Cx2FcHGDFisLHM8OGqFNjU5+I HepIdPjwcoy3kPDSfQ9WXx7Iz03tMCbhMWUhH9MRYuUAzCHgsAryZ4AnTBa+Hn7B 7WHuVf24eFcoJysoWGsbQZDzN5oxqIRXP2mA5k7MVemHV5L+7KV15KyJWaDqTdI+ DTpw8kP/WboloegmZmaqbPLlfvl91G8LjU5yfLaa+rNHkbyT4G1c3iQm5yLWlsYW yfGf+XiZPoF5S6862qdx7YPZG0yTkaUYU0Spnr8eV9wt9uUIp57jczrBzgBKYlN0 BdNv9DgqbGvhmdz/k95gRZUpdYAvF6J4+Y4h9uXgxqfdGZjFCSlegOG8gleCnvEw dfFqyyf+3ZQ= =be8O -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Solution:
For OpenShift Container Platform 4.8 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html
For Red Hat OpenShift Logging 5.1, see the following instructions to apply this update:
https://docs.openshift.com/container-platform/4.8/logging/cluster-logging-upgrading.html
- JIRA issues fixed (https://issues.jboss.org/):
LOG-1971 - Applying cluster state is causing elasticsearch to hit an issue and become unusable
The References section of this erratum contains a download link for the update. You must be logged in to download the update. ========================================================================= Ubuntu Security Notice USN-5192-2 December 17, 2021
apache-log4j2 vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 ESM
Summary:
Apache Log4j 2 could be made to crash or run programs as an administrator if it received a specially crafted input. This update provides the corresponding update for Ubuntu 16.04 ESM.
Original advisory details:
Chen Zhaojun discovered that Apache Log4j 2 allows remote attackers to run programs via a special crafted input. An attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04 ESM: liblog4j2-java 2.4-2ubuntu0.1~esm1
In general, a standard system update will make all the necessary changes.
2021-12-11: VMSA-2021-0028.1 Updated advisory with workaround information for multiple products including vCenter Server Appliance, vRealize Operations, Horizon, vRealize Log Insight, Unified Access Gateway.
2021-12-13: VMSA-2021-0028.2 Revised advisory with updates to multiple products. \x95 VMware HCX \x95 VMware NSX-T Data Center \x95 VMware WorkspaceOne Access \x95 VMware Identity Manager \x95 VMware vRealize Operations Cloud Proxy \x95 VMware vRealize Lifecycle Manager \x95 VMware Site Recovery Manager, vSphere Replication \x95 VMware Carbon Black Cloud Workload Appliance \x95 VMware Carbon Black EDR Server \x95 VMware Tanzu GemFire \x95 VMware Tanzu Greenplum \x95 VMware Tanzu Operations Manager \x95 VMware Tanzu Application Service for VMs \x95 VMware Tanzu Kubernetes Grid Integrated Edition \x95 VMware Tanzu Observability by Wavefront Nozzle \x95 Healthwatch for Tanzu Application Service \x95 Spring Cloud Services for VMware Tanzu \x95 API Portal for VMware Tanzu \x95 Single Sign-On for VMware Tanzu Application Service \x95 App Metrics \x95 VMware vCenter Cloud Gateway \x95 VMware Cloud Foundation \x95 VMware Workspace ONE Access Connector \x95 VMware Horizon DaaS \x95 VMware Horizon Cloud Connector \x95 VMware NSX Data Center for vSphere \x95 VMware AppDefense Appliance \x95 VMware Cloud Director Object Storage Extension
You are receiving this alert because you are subscribed to the VMware Security Announcements mailing list. To modify your subscription or unsubscribe please visit https://lists.vmware.com/mailman/listinfo/security-announce. Description:
Red Hat Process Automation Manager is an open source business process management suite that combines process management and decision service management and enables business and IT users to create, manage, validate, and deploy process applications and decision services.
Security Fix(es):
-
log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value (CVE-2021-44228)
-
jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception (CVE-2020-28491)
-
kubernetes-client: fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise (CVE-2021-20218)
-
xstream: Arbitrary code execution via unsafe deserialization of com.sun.corba.* (CVE-2021-39149)
-
xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration (CVE-2021-39145)
-
xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration (CVE-2021-39151)
-
xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapSearchEnumeration (CVE-2021-39147)
-
xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.toolkit.dir.ContextEnumerator (CVE-2021-39148)
-
xstream: Arbitrary code execution via unsafe deserialization of com.sun.xml.internal.ws.client.sei.* (CVE-2021-39141)
-
xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue (CVE-2021-39146)
-
xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue (CVE-2021-39154)
-
xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.* (CVE-2021-39144)
-
xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl (CVE-2021-39139)
-
xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl (CVE-2021-39153)
-
xstream: Infinite loop DoS via unsafe deserialization of sun.reflect.annotation.AnnotationInvocationHandler (CVE-2021-39140)
-
xstream: remote command execution attack by manipulating the processed input stream (CVE-2021-29505)
-
xstream: Server-side request forgery (SSRF) via unsafe deserialization of com.sun.xml.internal.ws.client.sei.* (CVE-2021-39150)
-
xstream: Server-side request forgery (SSRF) via unsafe deserialization of jdk.nashorn.internal.runtime.Source$URLData (CVE-2021-39152)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process. Bugs fixed (https://bugzilla.redhat.com/):
1923405 - CVE-2021-20218 fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise 1930423 - CVE-2020-28491 jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception 1966735 - CVE-2021-29505 XStream: remote command execution attack by manipulating the processed input stream 1997763 - CVE-2021-39139 xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl 1997765 - CVE-2021-39140 xstream: Infinite loop DoS via unsafe deserialization of sun.reflect.annotation.AnnotationInvocationHandler 1997769 - CVE-2021-39141 xstream: Arbitrary code execution via unsafe deserialization of com.sun.xml.internal.ws.client.sei. 1997772 - CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing. 1997775 - CVE-2021-39145 xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration 1997777 - CVE-2021-39146 xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue 1997779 - CVE-2021-39147 xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapSearchEnumeration 1997781 - CVE-2021-39148 xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.toolkit.dir.ContextEnumerator 1997784 - CVE-2021-39149 xstream: Arbitrary code execution via unsafe deserialization of com.sun.corba. 1997786 - CVE-2021-39150 xstream: Server-side request forgery (SSRF) via unsafe deserialization of com.sun.xml.internal.ws.client.sei. 1997791 - CVE-2021-39151 xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration 1997793 - CVE-2021-39152 xstream: Server-side request forgery (SSRF) via unsafe deserialization of jdk.nashorn.internal.runtime.Source$URLData 1997795 - CVE-2021-39153 xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl 1997801 - CVE-2021-39154 xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue 2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value
This update also fixes CVE-2020-9488 in the oldstable distribution (buster). Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.
For the oldstable distribution (buster), this problem has been fixed in version 2.15.0-1~deb10u1.
For the stable distribution (bullseye), this problem has been fixed in version 2.15.0-1~deb11u1.
We recommend that you upgrade your apache-log4j2 packages.
For the detailed security status of apache-log4j2 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/apache-log4j2
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmG0+YVfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7 UeQvXA/+LIMVC0X80Qc6No564VodtTN3Ci0NyaUcQyZG8Gyo2tPuwKEpOUpmom7f wcZvQgKvwxs3Ad1M5Zt/6Ql3v0KbwzBah0v8KUV86B6g4yb+Wno7iKQR1mN47bpz 2SJPzf6IECwtmz3zYI3fLuJJ/dvAMRlQ+nhPsC8/zJGJgfFHFmDyfG8TtlrYLUHS Pjpov4C/VllQGJ5MjyVF93OqTCy4V7WxH/RgT1YBOs71KNCq5yPoch35geytSQoM Kk59qFLQgST2kYhLVxRRbdQAAhbA7W5XythKqphon6nRmlJPHSGkXMf9s0N3cm6K Zkmvo2/A29FiceZj/bSM4/qw7gqbsJfpSMcTKmxhReolsXAJVj4mGu9cZZTAP7Tb g8fl8kGljFd01ka0208eFyILHCR2bAF2xgS1nG6TCc170azDkvW38fZHHkLQIPbF TOwxoNv8dHgyT6pfI+BDYKy9pNvrLk/jqXkOpry6nY+Ji/RcjGBDIR3VP25VsMk8 6zwERE1LX0IvwiaSFBg6oyWW4siINZzFyVXryLvRr/YBIAYKGv+Y1Wn8ageACItW 2SZjLbK4uBTOHyvPITBgOZSYD7kYcTPxdbb8ntw7Uo489hYXzjYlloTBoUPg1G3o gyZnRfW0yYf2bA63I7vVBDTITt8K4H1UkUDEOIUjXGekFLqDnGw= =BY2+ -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202112-0566",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "cloudcenter cost optimizer",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "5.5.2"
},
{
"model": "common services platform collector",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "002.009\\(001.002\\)"
},
{
"model": "network dashboard fabric controller",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.0\\(1\\)"
},
{
"model": "energyip",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "8.6"
},
{
"model": "firepower threat defense",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "6.2.3"
},
{
"model": "paging server",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "8.4\\(1\\)"
},
{
"model": "evolved programmable network manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.0"
},
{
"model": "automated subsea tuning",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "02.01.00"
},
{
"model": "log4j",
"scope": "gte",
"trust": 1.0,
"vendor": "apache",
"version": "2.0.1"
},
{
"model": "log4j",
"scope": "lt",
"trust": 1.0,
"vendor": "apache",
"version": "2.15.0"
},
{
"model": "enterprise chat and email",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.5\\(1\\)"
},
{
"model": "captial",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "2019.1"
},
{
"model": "firepower threat defense",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "6.5.0"
},
{
"model": "ucs central software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0\\(1c\\)"
},
{
"model": "sd-wan vmanage",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "20.4"
},
{
"model": "integrated management controller supervisor",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.3.2.1"
},
{
"model": "broadworks",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "cloudcenter suite",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.4\\(1\\)"
},
{
"model": "wan automation engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.6"
},
{
"model": "dna center",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.2.3.4"
},
{
"model": "contact center management portal",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.5\\(1\\)"
},
{
"model": "wan automation engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.2.3"
},
{
"model": "unified communications manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1.22900.28\\)"
},
{
"model": "energyip",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "8.5"
},
{
"model": "unity connection",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5"
},
{
"model": "sd-wan vmanage",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "20.7"
},
{
"model": "vm access proxy",
"scope": "lt",
"trust": 1.0,
"vendor": "snowsoftware",
"version": "3.6"
},
{
"model": "mendix",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "*"
},
{
"model": "connected analytics for network deployment",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "006.005.000.000"
},
{
"model": "unified computing system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "006.008\\(001.000\\)"
},
{
"model": "ucs central software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0"
},
{
"model": "desigo cc advanced reports",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "4.0"
},
{
"model": "dna center",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.1.2.8"
},
{
"model": "emergency responder",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(4.65000.14\\)"
},
{
"model": "operation scheduler",
"scope": "lte",
"trust": 1.0,
"vendor": "siemens",
"version": "1.1.3"
},
{
"model": "ucs central software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0\\(1b\\)"
},
{
"model": "firepower threat defense",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.1.0"
},
{
"model": "siveillance identity",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "1.5"
},
{
"model": "virtual topology system",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.6.6"
},
{
"model": "common services platform collector",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "002.009\\(001.001\\)"
},
{
"model": "captial",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "2019.1"
},
{
"model": "unity connection",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1.10000.6\\)"
},
{
"model": "e-car operation center",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "2021-12-13"
},
{
"model": "unified customer voice portal",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.6\\(1\\)"
},
{
"model": "crosswork network automation",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0.0"
},
{
"model": "intersight virtual appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "1.0.9-343"
},
{
"model": "ucs central software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0\\(1k\\)"
},
{
"model": "oneapi sample browser",
"scope": "eq",
"trust": 1.0,
"vendor": "intel",
"version": null
},
{
"model": "wan automation engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.5"
},
{
"model": "emergency responder",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5"
},
{
"model": "common services platform collector",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "002.010\\(000.000\\)"
},
{
"model": "identity services engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "003.001\\(000.518\\)"
},
{
"model": "unified customer voice portal",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.0"
},
{
"model": "sppa-t3000 ses3000",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "*"
},
{
"model": "intersight virtual appliance",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "1.0.9-361"
},
{
"model": "business process automation",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "3.0.000.115"
},
{
"model": "connected analytics for network deployment",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "008.000.000.000.004"
},
{
"model": "crosswork zero touch provisioning",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.0.0"
},
{
"model": "evolved programmable network manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "4.1"
},
{
"model": "nx",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "*"
},
{
"model": "dna spaces\\: connector",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.5"
},
{
"model": "unified contact center express",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.5\\(1\\)"
},
{
"model": "mobility services engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "integrated management controller supervisor",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.3.2.0"
},
{
"model": "firepower threat defense",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "6.3.0"
},
{
"model": "unified contact center enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.0\\(1\\)"
},
{
"model": "unified intelligence center",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.6\\(1\\)"
},
{
"model": "network dashboard fabric controller",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.4\\(1\\)"
},
{
"model": "unified workforce optimization",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1\\)"
},
{
"model": "webex meetings server",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "4.0"
},
{
"model": "paging server",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "8.3\\(1\\)"
},
{
"model": "xpedition package integrator",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": null
},
{
"model": "log4j",
"scope": "lt",
"trust": 1.0,
"vendor": "apache",
"version": "2.3.1"
},
{
"model": "xpedition enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": null
},
{
"model": "dna center",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "2.2.3.0"
},
{
"model": "dna center",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.2.2.8"
},
{
"model": "common services platform collector",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "002.009\\(000.001\\)"
},
{
"model": "business process automation",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "3.2.000.009"
},
{
"model": "gma-manager",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "8.6.2j-398"
},
{
"model": "siguard dsa",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "4.4"
},
{
"model": "paging server",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "9.0\\(1\\)"
},
{
"model": "common services platform collector",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.10.0.1"
},
{
"model": "sd-wan vmanage",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "20.6"
},
{
"model": "video surveillance manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.14\\(2.26\\)"
},
{
"model": "finesse",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.5\\(1\\)"
},
{
"model": "optical network controller",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "1.1"
},
{
"model": "sd-wan vmanage",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "20.8"
},
{
"model": "unified contact center express",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.5\\(1\\)"
},
{
"model": "unified intelligence center",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.6\\(2\\)"
},
{
"model": "industrial edge management",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "*"
},
{
"model": "cloud secure agent",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"model": "network services orchestrator",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "5.4"
},
{
"model": "fxos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "6.7.0"
},
{
"model": "ucs central software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0\\(1a\\)"
},
{
"model": "log4j",
"scope": "eq",
"trust": 1.0,
"vendor": "apache",
"version": "2.0"
},
{
"model": "identity services engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "002.004\\(000.914\\)"
},
{
"model": "wan automation engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.3"
},
{
"model": "synchro 4d",
"scope": "lt",
"trust": 1.0,
"vendor": "bentley",
"version": "6.2.4.2"
},
{
"model": "sentron powermanager",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "4.2"
},
{
"model": "fog director",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "video surveillance manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.14\\(1.26\\)"
},
{
"model": "comos",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "*"
},
{
"model": "crosswork network automation",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "4.1.0"
},
{
"model": "network services orchestrator",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "5.5.4.1"
},
{
"model": "navigator",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "2021-12-13"
},
{
"model": "evolved programmable network manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.0"
},
{
"model": "data center manager",
"scope": "lt",
"trust": 1.0,
"vendor": "intel",
"version": "5.1"
},
{
"model": "unified customer voice portal",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.6\\(1\\)"
},
{
"model": "sd-wan vmanage",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "20.4"
},
{
"model": "optical network controller",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "1.1.0"
},
{
"model": "crosswork zero touch provisioning",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0.1"
},
{
"model": "wan automation engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.4"
},
{
"model": "automated subsea tuning",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.1.0"
},
{
"model": "cloud manager",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "35"
},
{
"model": "broadworks",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2021.11_1.162"
},
{
"model": "identity services engine",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.4.0"
},
{
"model": "energyip prepay",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "3.8"
},
{
"model": "firepower threat defense",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.0.0"
},
{
"model": "common services platform collector",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "002.009\\(001.000\\)"
},
{
"model": "cloud connect",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.6\\(1\\)"
},
{
"model": "connected analytics for network deployment",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "006.004.000.003"
},
{
"model": "unified communications manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1\\)"
},
{
"model": "contact center domain manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.5\\(1\\)"
},
{
"model": "cloudcenter suite",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "4.10\\(0.15\\)"
},
{
"model": "energyip",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "8.7"
},
{
"model": "cloudcenter suite",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3\\(0\\)"
},
{
"model": "workload optimization manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "3.2.1"
},
{
"model": "paging server",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "8.5\\(1\\)"
},
{
"model": "nexus insights",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "6.0.2"
},
{
"model": "sentron powermanager",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "4.1"
},
{
"model": "siguard dsa",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "4.3"
},
{
"model": "unified communications manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1.17900.52\\)"
},
{
"model": "unity connection",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1\\)"
},
{
"model": "network insights for data center",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "6.0\\(2.1914\\)"
},
{
"model": "emergency responder",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(4\\)"
},
{
"model": "system debugger",
"scope": "eq",
"trust": 1.0,
"vendor": "intel",
"version": null
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "10.0"
},
{
"model": "enterprise chat and email",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.6\\(1\\)"
},
{
"model": "mindsphere",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "2021-12-11"
},
{
"model": "paging server",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "9.0\\(2\\)"
},
{
"model": "ontap tools",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"model": "log4j",
"scope": "gte",
"trust": 1.0,
"vendor": "apache",
"version": "2.13.0"
},
{
"model": "unified contact center enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.6\\(1\\)"
},
{
"model": "unified communications manager im \\\u0026 presence service",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1.22900.6\\)"
},
{
"model": "unified contact center enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.5\\(1\\)"
},
{
"model": "unified communications manager im \\\u0026 presence service",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1\\)"
},
{
"model": "sd-wan vmanage",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "20.6.1"
},
{
"model": "ucs central software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0\\(1d\\)"
},
{
"model": "unified communications manager im and presence service",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1\\)"
},
{
"model": "network dashboard fabric controller",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(3\\)"
},
{
"model": "common services platform collector",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "002.009\\(000.002\\)"
},
{
"model": "unified sip proxy",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "010.002\\(001\\)"
},
{
"model": "fxos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "6.4.0"
},
{
"model": "identity services engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "003.002\\(000.116\\)"
},
{
"model": "sd-wan vmanage",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "20.3"
},
{
"model": "connected analytics for network deployment",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "007.003.001.001"
},
{
"model": "sd-wan vmanage",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "20.3.4.1"
},
{
"model": "synchro",
"scope": "gte",
"trust": 1.0,
"vendor": "bentley",
"version": "6.1"
},
{
"model": "packaged contact center enterprise",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "11.6"
},
{
"model": "network services orchestrator",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "5.6"
},
{
"model": "unified communications manager im and presence service",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1\\)"
},
{
"model": "log4j",
"scope": "lt",
"trust": 1.0,
"vendor": "apache",
"version": "2.12.2"
},
{
"model": "cloudcenter suite admin",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3.1"
},
{
"model": "unified contact center enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.6\\(2\\)"
},
{
"model": "finesse",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.6\\(1\\)"
},
{
"model": "business process automation",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "3.1.000.000"
},
{
"model": "unified contact center enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.6\\(2\\)"
},
{
"model": "teamcenter",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "*"
},
{
"model": "customer experience cloud agent",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "1.12.1"
},
{
"model": "crosswork network controller",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.0.0"
},
{
"model": "active iq unified manager",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"model": "dna center",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "2.2.2.0"
},
{
"model": "network services orchestrator",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "crosswork platform infrastructure",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "4.0.1"
},
{
"model": "crosswork data gateway",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0.2"
},
{
"model": "cloudcenter suite",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.5\\(1\\)"
},
{
"model": "snow commander",
"scope": "lt",
"trust": 1.0,
"vendor": "snowsoftware",
"version": "8.10.0"
},
{
"model": "solid edge harness design",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "2020"
},
{
"model": "sd-wan vmanage",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "20.4.2.1"
},
{
"model": "siveillance identity",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "1.6"
},
{
"model": "connected analytics for network deployment",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "007.002.000"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "11.0"
},
{
"model": "cloudcenter suite",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.5\\(0\\)"
},
{
"model": "ucs central software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0\\(1l\\)"
},
{
"model": "fxos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "6.6.0"
},
{
"model": "wan automation engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.2.1"
},
{
"model": "email security",
"scope": "lt",
"trust": 1.0,
"vendor": "sonicwall",
"version": "10.0.12"
},
{
"model": "crosswork optimization engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.0.0"
},
{
"model": "smart phy",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.1.2"
},
{
"model": "smart phy",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.1.4"
},
{
"model": "desigo cc advanced reports",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "4.2"
},
{
"model": "solid edge cam pro",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "*"
},
{
"model": "unified contact center express",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.6\\(1\\)"
},
{
"model": "firepower threat defense",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "6.7.0"
},
{
"model": "prime service catalog",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.1"
},
{
"model": "snapcenter",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"model": "spectrum power 4",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "4.70"
},
{
"model": "cyber vision",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "4.0.2"
},
{
"model": "unified sip proxy",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "010.002\\(000\\)"
},
{
"model": "common services platform collector",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "002.009\\(000.000\\)"
},
{
"model": "cyber vision sensor management extension",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "4.0.2"
},
{
"model": "data center network manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.3\\(1\\)"
},
{
"model": "connected analytics for network deployment",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "007.003.003"
},
{
"model": "unified contact center express",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.6\\(2\\)"
},
{
"model": "sd-wan vmanage",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "20.6.2.1"
},
{
"model": "desigo cc advanced reports",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "4.1"
},
{
"model": "finesse",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.6\\(1\\)"
},
{
"model": "common services platform collector",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "2.10.0"
},
{
"model": "cyber vision sensor management extension",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "4.0.3"
},
{
"model": "ucs central software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0\\(1h\\)"
},
{
"model": "opcenter intelligence",
"scope": "lte",
"trust": 1.0,
"vendor": "siemens",
"version": "3.2"
},
{
"model": "evolved programmable network manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "4.0"
},
{
"model": "cx cloud agent",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "001.012"
},
{
"model": "sipass integrated",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "2.80"
},
{
"model": "connected analytics for network deployment",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "007.000.001"
},
{
"model": "genomics kernel library",
"scope": "eq",
"trust": 1.0,
"vendor": "intel",
"version": null
},
{
"model": "paging server",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.5\\(2\\)"
},
{
"model": "video surveillance manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.14\\(3.025\\)"
},
{
"model": "energy engage",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "3.1"
},
{
"model": "siveillance command",
"scope": "lte",
"trust": 1.0,
"vendor": "siemens",
"version": "4.16.2.1"
},
{
"model": "siveillance viewpoint",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "*"
},
{
"model": "vesys",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "2019.1"
},
{
"model": "desigo cc info center",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "5.1"
},
{
"model": "paging server",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "14.0\\(1\\)"
},
{
"model": "crosswork data gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.0.0"
},
{
"model": "secure device onboard",
"scope": "eq",
"trust": 1.0,
"vendor": "intel",
"version": null
},
{
"model": "connected analytics for network deployment",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "006.005.000."
},
{
"model": "fxos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.0.0"
},
{
"model": "connected analytics for network deployment",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.3"
},
{
"model": "smart phy",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "3.2.1"
},
{
"model": "data center network manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "11.3\\(1\\)"
},
{
"model": "dna center",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.2.2.8"
},
{
"model": "unified sip proxy",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "10.2.1v2"
},
{
"model": "unified customer voice portal",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.5"
},
{
"model": "siguard dsa",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "4.2"
},
{
"model": "firepower threat defense",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "6.4.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"model": "nexus dashboard",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.1.2"
},
{
"model": "energyip",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "9.0"
},
{
"model": "desigo cc info center",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "5.0"
},
{
"model": "crosswork network controller",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0.1"
},
{
"model": "identity services engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.4.0"
},
{
"model": "rhythmyx",
"scope": "lte",
"trust": 1.0,
"vendor": "percussion",
"version": "7.3.2"
},
{
"model": "cloudcenter workload manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "5.5.2"
},
{
"model": "ucs central software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0\\(1g\\)"
},
{
"model": "virtualized infrastructure manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "3.2.0"
},
{
"model": "unified sip proxy",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "010.000\\(001\\)"
},
{
"model": "vesys",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "2019.1"
},
{
"model": "iot operations dashboard",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "fxos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "6.2.3"
},
{
"model": "spectrum power 7",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "2.30"
},
{
"model": "sd-wan vmanage",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "20.5"
},
{
"model": "fxos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "6.5.0"
},
{
"model": "smart phy",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.2.1"
},
{
"model": "unified sip proxy",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "010.000\\(000\\)"
},
{
"model": "unified customer voice portal",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.5\\(1\\)"
},
{
"model": "virtual topology system",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.6.7"
},
{
"model": "network dashboard fabric controller",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1\\)"
},
{
"model": "network dashboard fabric controller",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.2\\(1\\)"
},
{
"model": "enterprise chat and email",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.0\\(1\\)"
},
{
"model": "spectrum power 7",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "2.30"
},
{
"model": "unified customer voice portal",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "11.6"
},
{
"model": "connected analytics for network deployment",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "007.003.000"
},
{
"model": "industrial edge management hub",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "2021-12-13"
},
{
"model": "desigo cc advanced reports",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "5.1"
},
{
"model": "connected analytics for network deployment",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "007.001.000"
},
{
"model": "solid edge harness design",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "2020"
},
{
"model": "computer vision annotation tool",
"scope": "eq",
"trust": 1.0,
"vendor": "intel",
"version": null
},
{
"model": "cloudcenter",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "4.10.0.16"
},
{
"model": "ucs central",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0\\(1p\\)"
},
{
"model": "integrated management controller supervisor",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "002.003\\(002.000\\)"
},
{
"model": "unified customer voice portal",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.6"
},
{
"model": "smart phy",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.1.3"
},
{
"model": "network assurance engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "6.0\\(2.1912\\)"
},
{
"model": "firepower threat defense",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "6.6.0"
},
{
"model": "crosswork network automation",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "dna spaces",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "wan automation engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.1.3"
},
{
"model": "unified intelligence center",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.6\\(1\\)"
},
{
"model": "identity services engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "003.000\\(000.458\\)"
},
{
"model": "fxos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.1.0"
},
{
"model": "wan automation engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.2.2"
},
{
"model": "webex meetings server",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "3.0"
},
{
"model": "network assurance engine",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "6.0.2"
},
{
"model": "head-end system universal device integration system",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "*"
},
{
"model": "virtualized voice browser",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.5\\(1\\)"
},
{
"model": "unified workforce optimization",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1\\)"
},
{
"model": "dna spaces connector",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "unified contact center management portal",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.6\\(1\\)"
},
{
"model": "enterprise chat and email",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.0\\(1\\)"
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "34"
},
{
"model": "smart phy",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "21.3"
},
{
"model": "desigo cc advanced reports",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "5.0"
},
{
"model": "siveillance vantage",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "*"
},
{
"model": "sd-wan vmanage",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "20.5"
},
{
"model": "unified communications manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1.18900.97\\)"
},
{
"model": "common services platform collector",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.9.1.3"
},
{
"model": "unified communications manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1\\)su3"
},
{
"model": "cloud insights",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"model": "evolved programmable network manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.1"
},
{
"model": "spectrum power 4",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "4.70"
},
{
"model": "network dashboard fabric controller",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.1\\(1\\)"
},
{
"model": "ucs central software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0\\(1e\\)"
},
{
"model": "advanced malware protection virtual private cloud appliance",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "3.5.4"
},
{
"model": "video surveillance manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "7.14\\(4.018\\)"
},
{
"model": "sensor solution development kit",
"scope": "eq",
"trust": 1.0,
"vendor": "intel",
"version": null
},
{
"model": "business process automation",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "3.1.000.044"
},
{
"model": "virtualized infrastructure manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "3.4.4"
},
{
"model": "crosswork network automation",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "4.1.1"
},
{
"model": "webex meetings server",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.0"
},
{
"model": "unified communications manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1.21900.40\\)"
},
{
"model": "crosswork optimization engine",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0.1"
},
{
"model": "crosswork platform infrastructure",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "4.1.0"
},
{
"model": "network services orchestrator",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "5.4.5.2"
},
{
"model": "network services orchestrator",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "5.6.3.1"
},
{
"model": "identity services engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "002.006\\(000.156\\)"
},
{
"model": "logo\\! soft comfort",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "*"
},
{
"model": "business process automation",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "3.2.000.000"
},
{
"model": "paging server",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "9.1\\(1\\)"
},
{
"model": "unified contact center enterprise",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "11.6\\(2\\)"
},
{
"model": "video surveillance operations manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "7.14.4"
},
{
"model": "evolved programmable network manager",
"scope": "lte",
"trust": 1.0,
"vendor": "cisco",
"version": "4.1.1"
},
{
"model": "unified customer voice portal",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.0\\(1\\)"
},
{
"model": "fxos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "6.3.0"
},
{
"model": "connected analytics for network deployment",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "008.000.000"
},
{
"model": "virtualized infrastructure manager",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "3.4.0"
},
{
"model": "wan automation engine",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "7.3.0.2"
},
{
"model": "ucs director",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "6.8.2.0"
},
{
"model": "system studio",
"scope": "eq",
"trust": 1.0,
"vendor": "intel",
"version": null
},
{
"model": "ucs central software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "2.0\\(1f\\)"
},
{
"model": "unified communications manager",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1\\)"
},
{
"model": "network dashboard fabric controller",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.3\\(1\\)"
},
{
"model": "network services orchestrator",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "5.5"
},
{
"model": "synchro",
"scope": "lt",
"trust": 1.0,
"vendor": "bentley",
"version": "6.4.3.2"
},
{
"model": "prime service catalog",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "12.1"
},
{
"model": "smart phy",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.1.5"
},
{
"model": "crosswork network automation",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.0.0"
},
{
"model": "log4j",
"scope": "gte",
"trust": 1.0,
"vendor": "apache",
"version": "2.4.0"
},
{
"model": "audio development kit",
"scope": "eq",
"trust": 1.0,
"vendor": "intel",
"version": null
},
{
"model": "identity services engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "002.007\\(000.356\\)"
},
{
"model": "sd-wan vmanage",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "20.5.1.1"
},
{
"model": "sd-wan vmanage",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "20.6"
},
{
"model": "evolved programmable network manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.1"
},
{
"model": "connected mobile experiences",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "paging server",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "14.4.1"
},
{
"model": "energyip prepay",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "3.7"
},
{
"model": "unified communications manager",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(1.18119.2\\)"
},
{
"model": "network services orchestrator",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3.5.1"
},
{
"model": "siveillance control pro",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "*"
},
{
"model": "sipass integrated",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "2.85"
},
{
"model": "oncommand insight",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"model": "emergency responder",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(4.66000.14\\)"
},
{
"model": "packaged contact center enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.6\\(1\\)"
},
{
"model": "network dashboard fabric controller",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "11.5\\(2\\)"
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-44228"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.15.0",
"versionStartIncluding": "2.13.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.3.1",
"versionStartIncluding": "2.0.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.12.2",
"versionStartIncluding": "2.4.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:sppa-t3000_ses3000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:logo\\!_soft_comfort:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:spectrum_power_4:4.70:sp7:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:spectrum_power_4:4.70:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.70",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:energyip_prepay:3.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:energyip_prepay:3.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:spectrum_power_4:4.70:sp8:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.16.2.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "8.6.2j-398",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:energyip:8.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:energyip:8.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:energyip:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:energy_engage:3.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:e-car_operation_center:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2021-12-13",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:desigo_cc_info_center:5.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:captial:2019.1:sp1912:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2021-12-13",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:xpedition_package_integrator:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:xpedition_enterprise:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:vesys:2019.1:sp1912:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:vesys:2019.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:vesys:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2019.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:vesys:2019.1:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:spectrum_power_7:2.30:sp2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:spectrum_power_7:2.30:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.30",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:spectrum_power_7:2.30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge_harness_design:2020:sp2002:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge_harness_design:2020:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge_harness_design:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2020",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:captial:2019.1:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge_harness_design:2020:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge_cam_pro:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:siveillance_viewpoint:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:siveillance_vantage:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:siguard_dsa:4.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:siguard_dsa:4.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:siguard_dsa:4.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:sentron_powermanager:4.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.1.3",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:nx:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "3.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:mindsphere:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2021-12-11",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:industrial_edge_management_hub:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2021-12-13",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:industrial_edge_management:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:captial:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2019.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:intel:audio_development_kit:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:intel:system_debugger:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:intel:secure_device_onboard:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:intel:oneapi_sample_browser:-:*:*:*:*:eclipse:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:intel:sensor_solution_firmware_development_kit:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:intel:computer_vision_annotation_tool:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:intel:genomics_kernel_library:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:intel:system_studio:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:intel:data_center_manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.0.12",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:cloud_insights:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:ontap_tools:-:*:*:*:*:vmware_vsphere:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:vmware_vsphere:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_customer_voice_portal:11.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:packaged_contact_center_enterprise:11.6\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:3.0:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.4.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:data_center_network_manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "11.3\\(1\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:4.0:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_express:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "12.5\\(1\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:data_center_network_manager:11.3\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3:-:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_service_pack_2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_service_pack_3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_security_patch4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:identity_services_engine:2.4.0:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:finesse:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "12.6\\(1\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:finesse:12.6\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:nexus_dashboard:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.1.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.6.3.1",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.5.4.1",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.3.5.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:iot_operations_dashboard:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:intersight_virtual_appliance:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.0.9-361",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.1.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.4.5.2",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:dna_spaces\\:_connector:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:cyber_vision_sensor_management_extension:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.0.3",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:crosswork_zero_touch_provisioning:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.0.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:crosswork_zero_touch_provisioning:3.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:crosswork_platform_infrastructure:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.0.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:crosswork_platform_infrastructure:4.1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:crosswork_optimization_engine:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.0.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:crosswork_optimization_engine:3.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:crosswork_network_controller:3.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:crosswork_network_controller:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.0.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:crosswork_data_gateway:3.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:crosswork_data_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.0.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:common_services_platform_collector:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.10.0.1",
"versionStartIncluding": "2.10.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:common_services_platform_collector:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.9.1.3",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:cloudcenter:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.10.0.16",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:cloudcenter_workload_manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.5.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:cloudcenter_suite_admin:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.3.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:cloudcenter_cost_optimizer:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.5.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:business_process_automation:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.000.009",
"versionStartIncluding": "3.2.000.000",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:business_process_automation:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.1.000.044",
"versionStartIncluding": "3.1.000.000",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:business_process_automation:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.0.000.115",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:automated_subsea_tuning:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.1.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:nexus_insights:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.0.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:advanced_malware_protection_virtual_private_cloud_appliance:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.5.4",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:customer_experience_cloud_agent:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.12.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_security_patch5:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:workload_optimization_manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ucs_central:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.0\\(1p\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.8.2.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "20.3.4.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:optical_network_controller:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.1.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:fog_director:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:dna_center:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.2.3.4",
"versionStartIncluding": "2.2.3.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "20.4.2.1",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.3.2.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:wan_automation_engine:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "7.3.0.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:virtualized_infrastructure_manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.4.4",
"versionStartIncluding": "3.4.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "20.5.1.1",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_assurance_engine:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.0.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:virtualized_infrastructure_manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:dna_center:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.1.2.8",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "20.6.2.1",
"versionStartIncluding": "20.6",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:virtual_topology_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.6.7",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:dna_center:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.2.2.8",
"versionStartIncluding": "2.2.2.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:smart_phy:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:prime_service_catalog:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "12.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:connected_mobile_experiences:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_operations_manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "7.14.4",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "11.5\\(1\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:virtualized_voice_browser:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "12.5\\(1\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:unified_workforce_optimization:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "11.5\\(1\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:unified_sip_proxy:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.2.1v2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:unified_intelligence_center:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "12.6\\(1\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_customer_voice_portal:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "11.6",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_customer_voice_portal:12.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_customer_voice_portal:12.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_enterprise:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "11.6\\(2\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_enterprise:11.6\\(2\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "11.5\\(1\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*",
"cpe_name": [],
"versionEndExcluding": "11.5\\(1\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*",
"cpe_name": [],
"versionEndExcluding": "11.5\\(1\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_manager:11.5\\(1\\)su3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_manager:11.5\\(1\\):*:*:*:session_management:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_manager:11.5\\(1\\):*:*:*:-:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:paging_server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "14.4.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_manager:11.5\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:packaged_contact_center_enterprise:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "11.6",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:enterprise_chat_and_email:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "12.0\\(1\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:emergency_responder:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "11.5\\(4\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:contact_center_management_portal:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "12.5\\(1\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:contact_center_domain_manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "12.5\\(1\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:cloud_connect:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "12.6\\(1\\)",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:broadworks:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2021.11_1.162",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:cisco:fxos:6.2.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:fxos:6.3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:fxos:6.4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:fxos:6.5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:fxos:6.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:fxos:6.7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:fxos:7.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:fxos:7.1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_1010:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_1120:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_1140:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_1150:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_2110:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_2120:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_2130:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_2140:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_4110:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_4112:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_4115:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_4120:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_4125:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_4140:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_4145:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_4150:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:prime_service_catalog:12.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:firepower_threat_defense:6.2.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:firepower_threat_defense:6.4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:firepower_threat_defense:6.3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:webex_meetings_server:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unity_connection:11.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:firepower_threat_defense:6.5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:firepower_threat_defense:6.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:sd-wan_vmanage:20.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:sd-wan_vmanage:20.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:sd-wan_vmanage:20.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_enterprise:11.6\\(2\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:cyber_vision_sensor_management_extension:4.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:dna_spaces_connector:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_sip_proxy:010.002\\(001\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_sip_proxy:010.002\\(000\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_sip_proxy:010.000\\(001\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_sip_proxy:010.000\\(000\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_intelligence_center:12.6\\(2\\):-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_intelligence_center:12.6\\(1\\):es02:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_intelligence_center:12.6\\(1\\):es01:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_intelligence_center:12.6\\(1\\):-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_customer_voice_portal:12.6\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_customer_voice_portal:12.5\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_customer_voice_portal:12.0\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_customer_voice_portal:11.6\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_express:12.5\\(1\\):su1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_express:12.5\\(1\\):-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_manager_im_\\\u0026_presence_service:11.5\\(1.22900.6\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_manager_im_\\\u0026_presence_service:11.5\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_manager:11.5\\(1.22900.28\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_manager:11.5\\(1.21900.40\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_manager:11.5\\(1.18900.97\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_manager:11.5\\(1.18119.2\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_communications_manager:11.5\\(1.17900.52\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:paging_server:9.1\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:paging_server:9.0\\(2\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:paging_server:9.0\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:paging_server:8.5\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:paging_server:8.4\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:paging_server:8.3\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:paging_server:14.0\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:paging_server:12.5\\(2\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_enterprise:12.6\\(2\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_enterprise:12.6\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_enterprise:12.5\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_enterprise:12.0\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:finesse:12.6\\(1\\):es03:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:finesse:12.6\\(1\\):es02:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:finesse:12.6\\(1\\):es01:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:finesse:12.6\\(1\\):-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:finesse:12.5\\(1\\):su2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:finesse:12.5\\(1\\):su1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:enterprise_chat_and_email:12.6\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:enterprise_chat_and_email:12.5\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:enterprise_chat_and_email:12.0\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:emergency_responder:11.5\\(4.66000.14\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:emergency_responder:11.5\\(4.65000.14\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:emergency_responder:11.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_management_portal:12.6\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_express:12.6\\(2\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_contact_center_express:12.6\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:broadworks:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_computing_system:006.008\\(001.000\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ucs_central_software:2.0\\(1l\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ucs_central_software:2.0\\(1k\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ucs_central_software:2.0\\(1h\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ucs_central_software:2.0\\(1g\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ucs_central_software:2.0\\(1f\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ucs_central_software:2.0\\(1e\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ucs_central_software:2.0\\(1d\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ucs_central_software:2.0\\(1c\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ucs_central_software:2.0\\(1b\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ucs_central_software:2.0\\(1a\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ucs_central_software:2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:integrated_management_controller_supervisor:2.3.2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:integrated_management_controller_supervisor:002.003\\(002.000\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:sd-wan_vmanage:20.6.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:sd-wan_vmanage:20.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:sd-wan_vmanage:20.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:sd-wan_vmanage:20.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:optical_network_controller:1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_assurance_engine:6.0\\(2.1912\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:dna_center:2.2.2.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:wan_automation_engine:7.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:wan_automation_engine:7.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:wan_automation_engine:7.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:wan_automation_engine:7.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:wan_automation_engine:7.2.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:wan_automation_engine:7.2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:wan_automation_engine:7.2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:wan_automation_engine:7.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:virtual_topology_system:2.6.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:smart_phy:3.2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:smart_phy:3.1.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:smart_phy:3.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:smart_phy:3.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:smart_phy:3.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:smart_phy:21.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_services_orchestrator:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:intersight_virtual_appliance:1.0.9-343:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:evolved_programmable_network_manager:5.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:evolved_programmable_network_manager:5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:evolved_programmable_network_manager:4.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:evolved_programmable_network_manager:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:evolved_programmable_network_manager:3.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:evolved_programmable_network_manager:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.5\\(3\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.5\\(2\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.5\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.4\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.3\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.2\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.1\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.0\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:7.14\\(4.018\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:7.14\\(3.025\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:7.14\\(2.26\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:7.14\\(1.26\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_workforce_optimization:11.5\\(1\\):sr7:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unity_connection:11.5\\(1.10000.6\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:cloudcenter_suite:5.3\\(0\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:cloudcenter_suite:5.5\\(0\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:cloudcenter_suite:5.4\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:automated_subsea_tuning:02.01.00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:identity_services_engine:003.002\\(000.116\\):-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:identity_services_engine:003.001\\(000.518\\):-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:identity_services_engine:003.000\\(000.458\\):-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:identity_services_engine:002.007\\(000.356\\):-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:identity_services_engine:002.006\\(000.156\\):-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:identity_services_engine:002.004\\(000.914\\):-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:firepower_threat_defense:7.1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:firepower_threat_defense:7.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:firepower_threat_defense:6.7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:network_insights_for_data_center:6.0\\(2.1914\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:cx_cloud_agent:001.012:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:mobility_services_engine:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:cloudcenter_suite:5.5\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:cloudcenter_suite:4.10\\(0.15\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:dna_spaces:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:cyber_vision:4.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:connected_analytics_for_network_deployment:7.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:connected_analytics_for_network_deployment:008.000.000.000.004:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:connected_analytics_for_network_deployment:008.000.000:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.003.003:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.003.001.001:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.003.000:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.002.000:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.001.000:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.000.001:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:connected_analytics_for_network_deployment:006.005.000.000:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:connected_analytics_for_network_deployment:006.005.000.:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:connected_analytics_for_network_deployment:006.004.000.003:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:crosswork_network_automation:4.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:crosswork_network_automation:4.1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:crosswork_network_automation:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:crosswork_network_automation:3.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:crosswork_network_automation:2.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:common_services_platform_collector:002.010\\(000.000\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:common_services_platform_collector:002.009\\(001.002\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:common_services_platform_collector:002.009\\(001.001\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:common_services_platform_collector:002.009\\(001.000\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:common_services_platform_collector:002.009\\(000.002\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:common_services_platform_collector:002.009\\(000.001\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:common_services_platform_collector:002.009\\(000.000\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:snowsoftware:vm_access_proxy:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.6",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:snowsoftware:snow_commander:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "8.10.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:bentley:synchro_4d:*:*:*:*:pro:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.2.4.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bentley:synchro:*:*:*:*:pro:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.4.3.2",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:percussion:rhythmyx:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.3.2",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-44228"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Much of the content of this vulnerability note is derived from Apache Log4j Security Vulnerabilities and http://slf4j.org/log4shell.html.This document was written by Art Manion.",
"sources": [
{
"db": "CERT/CC",
"id": "VU#930724"
}
],
"trust": 0.8
},
"cve": "CVE-2021-44228",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-407408",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 6.0,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2021-44228",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "CNNVD",
"id": "CNNVD-202112-799",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-407408",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-407408"
},
{
"db": "CNNVD",
"id": "CNNVD-202112-799"
},
{
"db": "NVD",
"id": "CVE-2021-44228"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. Apache Log4j allows insecure JNDI lookups that could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the vulnerable Java application using Log4j.CVE-2021-4104 Affected\nCVE-2021-44228 Affected\nCVE-2021-45046 AffectedCVE-2021-4104 Affected\nCVE-2021-44228 Affected\nCVE-2021-45046 Affected. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Critical: Red Hat Data Grid 8.2.2 security update\nAdvisory ID: RHSA-2021:5132-01\nProduct: Red Hat JBoss Data Grid\nAdvisory URL: https://access.redhat.com/errata/RHSA-2021:5132\nIssue date: 2021-12-14\nCVE Names: CVE-2021-44228 \n=====================================================================\n\n1. Summary:\n\nAn update for Red Hat Data Grid is now available. \n \nRed Hat Product Security has rated this update as having a security impact\nof Critical. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Description:\n\nRed Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. \nIt increases application response times and allows for dramatically\nimproving performance while providing availability, reliability, and\nelastic scale. \n \nData Grid 8.2.2 replaces Data Grid 8.2.1 and includes bug fixes and\nenhancements. Find out more about Data Grid 8.2.2 in the Release Notes [3]. \n\nSecurity Fix(es):\n\n* log4j-core: Remote code execution in Log4j 2.x when logs contain an\nattacker-controlled string value (CVE-2021-44228)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n3. Solution:\n\nTo install this update, do the following:\n \n1. Download the Data Grid 8.2.2 server patch from the customer portal[\u00b2]. \n2. Back up your existing Data Grid installation. You should back up\ndatabases, configuration files, and so on. \n3. Install the Data Grid 8.2.2 server patch. Refer to the 8.2.2 Release\nNotes[\u00b3] for patching instructions. \n4. Restart Data Grid to ensure the changes take effect. \n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2021-44228\nhttps://access.redhat.com/security/updates/classification/#critical\nhttps://access.redhat.com/jbossnetwork/restricted/softwareDetail.html?softwareId=70381\u0026product=data.grid\u0026version=8.2\u0026downloadType=patches\nhttps://access.redhat.com/documentation/en-us/red_hat_data_grid/8.2/html-single/red_hat_data_grid_8.2_release_notes/index\nhttps://access.redhat.com/security/vulnerabilities/RHSB-2021-009\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2021 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYblI0NzjgjWX9erEAQj7mw//TtZnFmrLI6Ts7uC19MnLA/vVPXT1i2Qz\nR1CZ4T7QCZkiJCNXvwYHj7iQgOm5o/seXRE38qGtJWqiyrZMGHVQnDl1Vuhm31jg\n6lxhpjn0kKKZanznosCxF3U2ovLhrEx+5in4piNiyV6CKkkgBV7UvESGWlIKiumq\n1r79DAQ7WdYPoOk+m+b5p/okFJXyD0FcEbrqZcgJQCmR9zyJ6DGAy4N9+cgEgGaC\nQoVZaXa+pUEVjiAOAg0XNcb+GyYSMFwkPUR14NI0V2OHIo97aBg9AG1HrOj3QmSG\n5LR/8zWQbfSbtTIzR67gBGF8F8nvnEeBARYje97Cx2FcHGDFisLHM8OGqFNjU5+I\nHepIdPjwcoy3kPDSfQ9WXx7Iz03tMCbhMWUhH9MRYuUAzCHgsAryZ4AnTBa+Hn7B\n7WHuVf24eFcoJysoWGsbQZDzN5oxqIRXP2mA5k7MVemHV5L+7KV15KyJWaDqTdI+\nDTpw8kP/WboloegmZmaqbPLlfvl91G8LjU5yfLaa+rNHkbyT4G1c3iQm5yLWlsYW\nyfGf+XiZPoF5S6862qdx7YPZG0yTkaUYU0Spnr8eV9wt9uUIp57jczrBzgBKYlN0\nBdNv9DgqbGvhmdz/k95gRZUpdYAvF6J4+Y4h9uXgxqfdGZjFCSlegOG8gleCnvEw\ndfFqyyf+3ZQ=\n=be8O\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n. Solution:\n\nFor OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nFor Red Hat OpenShift Logging 5.1, see the following instructions to apply\nthis update:\n\nhttps://docs.openshift.com/container-platform/4.8/logging/cluster-logging-upgrading.html\n\n4. JIRA issues fixed (https://issues.jboss.org/):\n\nLOG-1971 - Applying cluster state is causing elasticsearch to hit an issue and become unusable\n\n6. \n\nThe References section of this erratum contains a download link for the\nupdate. You must be logged in to download the update. =========================================================================\nUbuntu Security Notice USN-5192-2\nDecember 17, 2021\n\napache-log4j2 vulnerability\n=========================================================================\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 16.04 ESM\n\nSummary:\n\nApache Log4j 2 could be made to crash or run programs as an administrator\nif it received a specially crafted input. This update provides\nthe corresponding update for Ubuntu 16.04 ESM. \n\nOriginal advisory details:\n\n Chen Zhaojun discovered that Apache Log4j 2 allows remote attackers to run\n programs via a special crafted input. An attacker could use this vulnerability\n to cause a denial of service or possibly execute arbitrary code. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 16.04 ESM:\n liblog4j2-java 2.4-2ubuntu0.1~esm1\n\nIn general, a standard system update will make all the necessary changes. \n\n2021-12-11: VMSA-2021-0028.1\nUpdated advisory with workaround information for multiple products including vCenter Server Appliance, vRealize Operations, Horizon, vRealize Log Insight, Unified Access Gateway. \n\n2021-12-13: VMSA-2021-0028.2\nRevised advisory with updates to multiple products. \n\\x95\tVMware HCX\n\\x95\tVMware NSX-T Data Center\n\\x95\tVMware WorkspaceOne Access\n\\x95\tVMware Identity Manager \n\\x95\tVMware vRealize Operations Cloud Proxy\n\\x95\tVMware vRealize Lifecycle Manager\n\\x95\tVMware Site Recovery Manager, vSphere Replication\n\\x95\tVMware Carbon Black Cloud Workload Appliance\n\\x95\tVMware Carbon Black EDR Server\n\\x95\tVMware Tanzu GemFire\n\\x95\tVMware Tanzu Greenplum\n\\x95\tVMware Tanzu Operations Manager\n\\x95\tVMware Tanzu Application Service for VMs\n\\x95\tVMware Tanzu Kubernetes Grid Integrated Edition\n\\x95\tVMware Tanzu Observability by Wavefront Nozzle\n\\x95\tHealthwatch for Tanzu Application Service\n\\x95\tSpring Cloud Services for VMware Tanzu\n\\x95\tAPI Portal for VMware Tanzu\n\\x95\tSingle Sign-On for VMware Tanzu Application Service\n\\x95\tApp Metrics\n\\x95\tVMware vCenter Cloud Gateway\n\\x95\tVMware Cloud Foundation\n\\x95\tVMware Workspace ONE Access Connector\n\\x95\tVMware Horizon DaaS\n\\x95\tVMware Horizon Cloud Connector\n\\x95\tVMware NSX Data Center for vSphere\n\\x95\tVMware AppDefense Appliance\n\\x95\tVMware Cloud Director Object Storage Extension\n\nYou are receiving this alert because you are subscribed to the VMware Security Announcements mailing list. To modify your subscription or unsubscribe please visit https://lists.vmware.com/mailman/listinfo/security-announce. Description:\n\nRed Hat Process Automation Manager is an open source business process\nmanagement suite that combines process management and decision service\nmanagement and enables business and IT users to create, manage, validate,\nand deploy process applications and decision services. \n\nSecurity Fix(es):\n\n* log4j-core: Remote code execution in Log4j 2.x when logs contain an\nattacker-controlled string value (CVE-2021-44228)\n\n* jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a\njava.lang.OutOfMemoryError exception (CVE-2020-28491)\n\n* kubernetes-client: fabric8-kubernetes-client: vulnerable to a path\ntraversal leading to integrity and availability compromise (CVE-2021-20218)\n\n* xstream: Arbitrary code execution via unsafe deserialization of\ncom.sun.corba.* (CVE-2021-39149)\n\n* xstream: Arbitrary code execution via unsafe deserialization of\ncom.sun.jndi.ldap.LdapBindingEnumeration (CVE-2021-39145)\n\n* xstream: Arbitrary code execution via unsafe deserialization of\ncom.sun.jndi.ldap.LdapBindingEnumeration (CVE-2021-39151)\n\n* xstream: Arbitrary code execution via unsafe deserialization of\ncom.sun.jndi.ldap.LdapSearchEnumeration (CVE-2021-39147)\n\n* xstream: Arbitrary code execution via unsafe deserialization of\ncom.sun.jndi.toolkit.dir.ContextEnumerator (CVE-2021-39148)\n\n* xstream: Arbitrary code execution via unsafe deserialization of\ncom.sun.xml.internal.ws.client.sei.* (CVE-2021-39141)\n\n* xstream: Arbitrary code execution via unsafe deserialization of\njavax.swing.UIDefaults$ProxyLazyValue (CVE-2021-39146)\n\n* xstream: Arbitrary code execution via unsafe deserialization of\njavax.swing.UIDefaults$ProxyLazyValue (CVE-2021-39154)\n\n* xstream: Arbitrary code execution via unsafe deserialization of\nsun.tracing.* (CVE-2021-39144)\n\n* xstream: Arbitrary code execution via unsafe deserialization of Xalan\nxsltc.trax.TemplatesImpl (CVE-2021-39139)\n\n* xstream: Arbitrary code execution via unsafe deserialization of Xalan\nxsltc.trax.TemplatesImpl (CVE-2021-39153)\n\n* xstream: Infinite loop DoS via unsafe deserialization of\nsun.reflect.annotation.AnnotationInvocationHandler (CVE-2021-39140)\n\n* xstream: remote command execution attack by manipulating the processed\ninput stream (CVE-2021-29505)\n\n* xstream: Server-side request forgery (SSRF) via unsafe deserialization of\ncom.sun.xml.internal.ws.client.sei.* (CVE-2021-39150)\n\n* xstream: Server-side request forgery (SSRF) via unsafe deserialization of\njdk.nashorn.internal.runtime.Source$URLData (CVE-2021-39152)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update; after installing the update,\nrestart the server by starting the JBoss Application Server process. Bugs fixed (https://bugzilla.redhat.com/):\n\n1923405 - CVE-2021-20218 fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise\n1930423 - CVE-2020-28491 jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception\n1966735 - CVE-2021-29505 XStream: remote command execution attack by manipulating the processed input stream\n1997763 - CVE-2021-39139 xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl\n1997765 - CVE-2021-39140 xstream: Infinite loop DoS via unsafe deserialization of sun.reflect.annotation.AnnotationInvocationHandler\n1997769 - CVE-2021-39141 xstream: Arbitrary code execution via unsafe deserialization of com.sun.xml.internal.ws.client.sei.*\n1997772 - CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*\n1997775 - CVE-2021-39145 xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration\n1997777 - CVE-2021-39146 xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue\n1997779 - CVE-2021-39147 xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapSearchEnumeration\n1997781 - CVE-2021-39148 xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.toolkit.dir.ContextEnumerator\n1997784 - CVE-2021-39149 xstream: Arbitrary code execution via unsafe deserialization of com.sun.corba.*\n1997786 - CVE-2021-39150 xstream: Server-side request forgery (SSRF) via unsafe deserialization of com.sun.xml.internal.ws.client.sei.*\n1997791 - CVE-2021-39151 xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration\n1997793 - CVE-2021-39152 xstream: Server-side request forgery (SSRF) via unsafe deserialization of jdk.nashorn.internal.runtime.Source$URLData\n1997795 - CVE-2021-39153 xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl\n1997801 - CVE-2021-39154 xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue\n2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value\n\n5. \n\nThis update also fixes CVE-2020-9488 in the oldstable distribution\n(buster). Improper validation of certificate with host mismatch in Apache Log4j\nSMTP appender. This could allow an SMTPS connection to be intercepted by a\nman-in-the-middle attack which could leak any log messages sent through that\nappender. \n\nFor the oldstable distribution (buster), this problem has been fixed\nin version 2.15.0-1~deb10u1. \n\nFor the stable distribution (bullseye), this problem has been fixed in\nversion 2.15.0-1~deb11u1. \n\nWe recommend that you upgrade your apache-log4j2 packages. \n\nFor the detailed security status of apache-log4j2 please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/apache-log4j2\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmG0+YVfFIAAAAAALgAo\naXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD\nRjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7\nUeQvXA/+LIMVC0X80Qc6No564VodtTN3Ci0NyaUcQyZG8Gyo2tPuwKEpOUpmom7f\nwcZvQgKvwxs3Ad1M5Zt/6Ql3v0KbwzBah0v8KUV86B6g4yb+Wno7iKQR1mN47bpz\n2SJPzf6IECwtmz3zYI3fLuJJ/dvAMRlQ+nhPsC8/zJGJgfFHFmDyfG8TtlrYLUHS\nPjpov4C/VllQGJ5MjyVF93OqTCy4V7WxH/RgT1YBOs71KNCq5yPoch35geytSQoM\nKk59qFLQgST2kYhLVxRRbdQAAhbA7W5XythKqphon6nRmlJPHSGkXMf9s0N3cm6K\nZkmvo2/A29FiceZj/bSM4/qw7gqbsJfpSMcTKmxhReolsXAJVj4mGu9cZZTAP7Tb\ng8fl8kGljFd01ka0208eFyILHCR2bAF2xgS1nG6TCc170azDkvW38fZHHkLQIPbF\nTOwxoNv8dHgyT6pfI+BDYKy9pNvrLk/jqXkOpry6nY+Ji/RcjGBDIR3VP25VsMk8\n6zwERE1LX0IvwiaSFBg6oyWW4siINZzFyVXryLvRr/YBIAYKGv+Y1Wn8ageACItW\n2SZjLbK4uBTOHyvPITBgOZSYD7kYcTPxdbb8ntw7Uo489hYXzjYlloTBoUPg1G3o\ngyZnRfW0yYf2bA63I7vVBDTITt8K4H1UkUDEOIUjXGekFLqDnGw=\n=BY2+\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-44228"
},
{
"db": "CERT/CC",
"id": "VU#930724"
},
{
"db": "VULHUB",
"id": "VHN-407408"
},
{
"db": "PACKETSTORM",
"id": "165293"
},
{
"db": "PACKETSTORM",
"id": "165286"
},
{
"db": "PACKETSTORM",
"id": "165290"
},
{
"db": "PACKETSTORM",
"id": "165291"
},
{
"db": "PACKETSTORM",
"id": "165324"
},
{
"db": "PACKETSTORM",
"id": "165329"
},
{
"db": "PACKETSTORM",
"id": "165333"
},
{
"db": "PACKETSTORM",
"id": "165348"
},
{
"db": "PACKETSTORM",
"id": "165260"
},
{
"db": "PACKETSTORM",
"id": "165733"
},
{
"db": "PACKETSTORM",
"id": "169172"
}
],
"trust": 2.7
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-407408",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-407408"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2021-44228",
"trust": 3.6
},
{
"db": "CERT/CC",
"id": "VU#930724",
"trust": 2.5
},
{
"db": "PACKETSTORM",
"id": "165260",
"trust": 1.8
},
{
"db": "PACKETSTORM",
"id": "165311",
"trust": 1.7
},
{
"db": "PACKETSTORM",
"id": "165225",
"trust": 1.7
},
{
"db": "PACKETSTORM",
"id": "165532",
"trust": 1.7
},
{
"db": "PACKETSTORM",
"id": "165281",
"trust": 1.7
},
{
"db": "PACKETSTORM",
"id": "165306",
"trust": 1.7
},
{
"db": "PACKETSTORM",
"id": "165673",
"trust": 1.7
},
{
"db": "PACKETSTORM",
"id": "165282",
"trust": 1.7
},
{
"db": "PACKETSTORM",
"id": "165371",
"trust": 1.7
},
{
"db": "PACKETSTORM",
"id": "167794",
"trust": 1.7
},
{
"db": "PACKETSTORM",
"id": "167917",
"trust": 1.7
},
{
"db": "PACKETSTORM",
"id": "165270",
"trust": 1.7
},
{
"db": "PACKETSTORM",
"id": "165261",
"trust": 1.7
},
{
"db": "PACKETSTORM",
"id": "165642",
"trust": 1.7
},
{
"db": "PACKETSTORM",
"id": "165307",
"trust": 1.7
},
{
"db": "SIEMENS",
"id": "SSA-479842",
"trust": 1.7
},
{
"db": "SIEMENS",
"id": "SSA-714170",
"trust": 1.7
},
{
"db": "SIEMENS",
"id": "SSA-661247",
"trust": 1.7
},
{
"db": "SIEMENS",
"id": "SSA-397453",
"trust": 1.7
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2021/12/13/1",
"trust": 1.7
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2021/12/14/4",
"trust": 1.7
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2021/12/10/3",
"trust": 1.7
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2021/12/13/2",
"trust": 1.7
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2021/12/10/2",
"trust": 1.7
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2021/12/15/3",
"trust": 1.7
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2021/12/10/1",
"trust": 1.7
},
{
"db": "PACKETSTORM",
"id": "171626",
"trust": 1.6
},
{
"db": "PACKETSTORM",
"id": "165324",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "165733",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "165348",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "166313",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "165279",
"trust": 0.7
},
{
"db": "EXPLOIT-DB",
"id": "50592",
"trust": 0.7
},
{
"db": "CS-HELP",
"id": "SB2022060708",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022012045",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022010629",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022072076",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022021428",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022071316",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022062001",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021122212",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022010908",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021122403",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021121720",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021123016",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022010421",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022031501",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021122907",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022012732",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021121652",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021121492",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022010522",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021121201",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021121535",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021122721",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021122018",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022032006",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022060808",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022011732",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021122401",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021121350",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022030923",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021122811",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022020607",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022012439",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022011042",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022021807",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022010322",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021122122",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.0090",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.0492",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4211",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4187.6",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.0237",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4236",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.0332",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.0080",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4186.4",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4269",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4198",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4316",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4274",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.0247",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.1188",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4302.3",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4256.2",
"trust": 0.6
},
{
"db": "CXSECURITY",
"id": "WLB-2022120027",
"trust": 0.6
},
{
"db": "CXSECURITY",
"id": "WLB-2021120069",
"trust": 0.6
},
{
"db": "CXSECURITY",
"id": "WLB-2022080025",
"trust": 0.6
},
{
"db": "CXSECURITY",
"id": "WLB-2022010065",
"trust": 0.6
},
{
"db": "LENOVO",
"id": "LEN-76573",
"trust": 0.6
},
{
"db": "ICS CERT",
"id": "ICSA-21-357-02",
"trust": 0.6
},
{
"db": "ICS CERT",
"id": "ICSA-22-034-01",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "51183",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202112-799",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "165293",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "165329",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "165333",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "165290",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "165291",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "165343",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "165520",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "165295",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "165285",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "165297",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "165298",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "165326",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "165289",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "165264",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "165632",
"trust": 0.1
},
{
"db": "EXPLOIT-DB",
"id": "50590",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-407408",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "165286",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "169172",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#930724"
},
{
"db": "VULHUB",
"id": "VHN-407408"
},
{
"db": "PACKETSTORM",
"id": "165293"
},
{
"db": "PACKETSTORM",
"id": "165286"
},
{
"db": "PACKETSTORM",
"id": "165290"
},
{
"db": "PACKETSTORM",
"id": "165291"
},
{
"db": "PACKETSTORM",
"id": "165324"
},
{
"db": "PACKETSTORM",
"id": "165329"
},
{
"db": "PACKETSTORM",
"id": "165333"
},
{
"db": "PACKETSTORM",
"id": "165348"
},
{
"db": "PACKETSTORM",
"id": "165260"
},
{
"db": "PACKETSTORM",
"id": "165733"
},
{
"db": "PACKETSTORM",
"id": "169172"
},
{
"db": "CNNVD",
"id": "CNNVD-202112-799"
},
{
"db": "NVD",
"id": "CVE-2021-44228"
}
]
},
"id": "VAR-202112-0566",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-407408"
}
],
"trust": 0.7309832957142857
},
"last_update_date": "2024-07-23T21:58:00.289000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Apache Log4j Fixes for code issue vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=174249"
}
],
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202112-799"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.1
},
{
"problemtype": "CWE-400",
"trust": 1.1
},
{
"problemtype": "CWE-502",
"trust": 1.1
},
{
"problemtype": "CWE-917",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-407408"
},
{
"db": "NVD",
"id": "CVE-2021-44228"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-apache-log4j-qruknebd"
},
{
"trust": 2.3,
"url": "http://packetstormsecurity.com/files/167917/mobileiron-log4shell-remote-command-execution.html"
},
{
"trust": 2.3,
"url": "http://packetstormsecurity.com/files/165225/apache-log4j2-2.14.1-remote-code-execution.html"
},
{
"trust": 2.3,
"url": "http://packetstormsecurity.com/files/165311/log4j-scan-extensive-scanner.html"
},
{
"trust": 2.3,
"url": "http://packetstormsecurity.com/files/165371/vmware-security-advisory-2021-0028.4.html"
},
{
"trust": 2.3,
"url": "http://packetstormsecurity.com/files/165532/log4shell-http-header-injection.html"
},
{
"trust": 2.3,
"url": "http://packetstormsecurity.com/files/165642/vmware-vcenter-server-unauthenticated-log4shell-jndi-injection-remote-code-execution.html"
},
{
"trust": 2.3,
"url": "http://packetstormsecurity.com/files/165673/unifi-network-application-unauthenticated-log4shell-remote-code-execution.html"
},
{
"trust": 1.7,
"url": "https://www.kb.cert.org/vuls/id/930724"
},
{
"trust": 1.7,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf"
},
{
"trust": 1.7,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf"
},
{
"trust": 1.7,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf"
},
{
"trust": 1.7,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf"
},
{
"trust": 1.7,
"url": "https://psirt.global.sonicwall.com/vuln-detail/snwlid-2021-0032"
},
{
"trust": 1.7,
"url": "https://security.netapp.com/advisory/ntap-20211210-0007/"
},
{
"trust": 1.7,
"url": "https://support.apple.com/kb/ht213189"
},
{
"trust": 1.7,
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html"
},
{
"trust": 1.7,
"url": "https://www.oracle.com/security-alerts/alert-cve-2021-44228.html"
},
{
"trust": 1.7,
"url": "https://www.debian.org/security/2021/dsa-5020"
},
{
"trust": 1.7,
"url": "http://seclists.org/fulldisclosure/2022/mar/23"
},
{
"trust": 1.7,
"url": "http://seclists.org/fulldisclosure/2022/jul/11"
},
{
"trust": 1.7,
"url": "http://seclists.org/fulldisclosure/2022/dec/2"
},
{
"trust": 1.7,
"url": "http://packetstormsecurity.com/files/167794/open-xchange-app-suite-7.10.x-cross-site-scripting-command-injection.html"
},
{
"trust": 1.7,
"url": "https://github.com/nu11secur1ty/cve-mitre/tree/main/cve-2021-44228"
},
{
"trust": 1.7,
"url": "https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html"
},
{
"trust": 1.7,
"url": "http://packetstormsecurity.com/files/165260/vmware-security-advisory-2021-0028.html"
},
{
"trust": 1.7,
"url": "http://packetstormsecurity.com/files/165261/apache-log4j2-2.14.1-information-disclosure.html"
},
{
"trust": 1.7,
"url": "http://packetstormsecurity.com/files/165270/apache-log4j2-2.14.1-remote-code-execution.html"
},
{
"trust": 1.7,
"url": "http://packetstormsecurity.com/files/165281/log4j2-log4shell-regexes.html"
},
{
"trust": 1.7,
"url": "http://packetstormsecurity.com/files/165282/log4j-payload-generator.html"
},
{
"trust": 1.7,
"url": "http://packetstormsecurity.com/files/165306/l4sh-log4j-remote-code-execution.html"
},
{
"trust": 1.7,
"url": "http://packetstormsecurity.com/files/165307/log4j-remote-code-execution-word-bypassing.html"
},
{
"trust": 1.7,
"url": "https://github.com/cisagov/log4j-affected-db/blob/develop/software-list.md"
},
{
"trust": 1.7,
"url": "https://logging.apache.org/log4j/2.x/security.html"
},
{
"trust": 1.7,
"url": "https://twitter.com/kurtseifried/status/1469345530182455296"
},
{
"trust": 1.7,
"url": "https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001"
},
{
"trust": 1.7,
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"trust": 1.7,
"url": "https://www.oracle.com/security-alerts/cpujan2022.html"
},
{
"trust": 1.7,
"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html"
},
{
"trust": 1.7,
"url": "http://www.openwall.com/lists/oss-security/2021/12/10/1"
},
{
"trust": 1.7,
"url": "http://www.openwall.com/lists/oss-security/2021/12/10/2"
},
{
"trust": 1.7,
"url": "http://www.openwall.com/lists/oss-security/2021/12/10/3"
},
{
"trust": 1.7,
"url": "http://www.openwall.com/lists/oss-security/2021/12/13/1"
},
{
"trust": 1.7,
"url": "http://www.openwall.com/lists/oss-security/2021/12/13/2"
},
{
"trust": 1.7,
"url": "http://www.openwall.com/lists/oss-security/2021/12/14/4"
},
{
"trust": 1.7,
"url": "http://www.openwall.com/lists/oss-security/2021/12/15/3"
},
{
"trust": 1.7,
"url": "https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/"
},
{
"trust": 1.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-44228"
},
{
"trust": 1.6,
"url": "http://packetstormsecurity.com/files/171626/ad-manager-plus-7122-remote-code-execution.html"
},
{
"trust": 1.3,
"url": "https://access.redhat.com/security/cve/cve-2021-44228"
},
{
"trust": 1.1,
"url": "https://github.com/cisagov/log4j-affected-db"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/m5csvunv4hwzzxgoknsk6l7rpm7bokib/"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/vu57ujdcfiasio35gc55jmksrxjmcdfm/"
},
{
"trust": 0.8,
"url": "cve-2021-4104 "
},
{
"trust": 0.8,
"url": "cve-2021-44228 "
},
{
"trust": 0.8,
"url": "cve-2021-45046 "
},
{
"trust": 0.7,
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/m5csvunv4hwzzxgoknsk6l7rpm7bokib/"
},
{
"trust": 0.7,
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/vu57ujdcfiasio35gc55jmksrxjmcdfm/"
},
{
"trust": 0.7,
"url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.7,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.7,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/security/vulnerabilities/rhsb-2021-009"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022010908"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022060808"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022010629"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022072076"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/165733/red-hat-security-advisory-2022-0296-03.html"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/support/pages/node/6527216"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4186.4"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4316"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.0080"
},
{
"trust": 0.6,
"url": "https://msrc.microsoft.com/update-guide/vulnerability/cve-2021-44228"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/support/pages/node/6528268"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021122212"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022012732"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021121201"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4302.3"
},
{
"trust": 0.6,
"url": "https://www.exploit-db.com/exploits/50592"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/issue/wlb-2022080025"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022011042"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021121720"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021122018"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.0237"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021122811"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/issue/wlb-2022010065"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021122401"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022011732"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022021807"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/165324/ubuntu-security-notice-usn-5197-1.html"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021123016"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021121350"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4211"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021122122"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022062001"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021122403"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021122721"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022010522"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022010322"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/issue/wlb-2022120027"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/support/pages/node/6525816"
},
{
"trust": 0.6,
"url": "https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20211215-01-log4j-cn"
},
{
"trust": 0.6,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-357-02"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021122907"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022060708"
},
{
"trust": 0.6,
"url": "https://www.exploit-db.com/exploits/51183"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022021428"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/166313/apple-security-advisory-2022-03-14-7.html"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/support/pages/node/6526220"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/apache-log4j-code-execution-via-jndi-remote-class-injection-37049"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4269"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-us/ht213189"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022012439"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022020607"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4256.2"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022071316"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022032006"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.0332"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022030923"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.1188"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.0492"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/support/pages/node/6526754"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/issue/wlb-2021120069"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.0090"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4236"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021121652"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/support/pages/node/6527330"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4198"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021121492"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4187.6"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022031501"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/165279/ubuntu-security-notice-usn-5192-1.html"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/165348/ubuntu-security-notice-usn-5192-2.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4274"
},
{
"trust": 0.6,
"url": "https://support.lenovo.com/us/en/product_security/len-76573"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022012045"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021121535"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022010421"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.0247"
},
{
"trust": 0.6,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-034-01"
},
{
"trust": 0.3,
"url": "https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html"
},
{
"trust": 0.2,
"url": "https://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2021-45046"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-45046"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2021:5132"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/red_hat_data_grid/8.2/html-single/red_hat_data_grid_8.2_release_notes/index"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/jbossnetwork/restricted/softwaredetail.html?softwareid=70381\u0026product=data.grid\u0026version=8.2\u0026downloadtype=patches"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-16135"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3200"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-25013"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-25012"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-35522"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-5827"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-35524"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-20673"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-25013"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-25009"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-27645"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-33574"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-13435"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-5827"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-24370"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-43527"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-14145"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-13751"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-25014"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-19603"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-14145"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-25012"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-35521"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-35942"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-17594"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-35524"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-24370"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3572"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-12762"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-36086"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3778"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-35522"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-13750"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-13751"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-22898"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-12762"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-16135"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-36084"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-37136"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-17541"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3800"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-17594"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-36087"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-36331"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3712"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-31535"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-35523"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-23841"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3445"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-13435"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-19603"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-22925"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2021:5128"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-20673"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-23840"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-36330"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-18218"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-20232"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-20266"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-20838"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-22876"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-20231"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-36332"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-14155"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-25010"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-20838"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-17541"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-25014"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-36085"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-37137"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-21409"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-33560"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-17595"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3481"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-42574"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-14155"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-25009"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-25010"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-35523"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-28153"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-13750"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3426"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-18218"
},
{
"trust": 0.1,
"url": "https://docs.openshift.com/container-platform/4.8/logging/cluster-logging-upgrading.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3580"
},
{
"trust": 0.1,
"url": "https://issues.jboss.org/):"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3796"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-17595"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-36330"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-35521"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2021:5093"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product\\xcatrhoar.eclipse.vertx\u0026version=4.1.5.sp1"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/red_hat_build_of_eclipse_vert.x/4.1/html/release_notes_for_eclipse_vert.x_4.1/index"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2021:5108"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/apache-log4j2/2.16.0-0.21.10.1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/apache-log4j2/2.16.0-0.20.04.1"
},
{
"trust": 0.1,
"url": "https://ubuntu.com/security/notices/usn-5197-1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/apache-log4j2/2.16.0-0.21.04.1"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-4104"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-4104"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2021:5148"
},
{
"trust": 0.1,
"url": "https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2021:5106"
},
{
"trust": 0.1,
"url": "https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html"
},
{
"trust": 0.1,
"url": "https://ubuntu.com/security/notices/usn-5192-1"
},
{
"trust": 0.1,
"url": "https://ubuntu.com/security/notices/usn-5192-2"
},
{
"trust": 0.1,
"url": "https://www.vmware.com/security/advisories/vmsa-2021-0028.html"
},
{
"trust": 0.1,
"url": "http://lists.vmware.com/mailman/listinfo/security-announce"
},
{
"trust": 0.1,
"url": "https://lists.vmware.com/mailman/listinfo/security-announce."
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-39139"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-39141"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-39154"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-20218"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-20218"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-29505"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-39145"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2022:0296"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-39144"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-39149"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-39150"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-39151"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-39140"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-39148"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-29505"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-39151"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-39153"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-39152"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-39147"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-39150"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-39139"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-39153"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-39144"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-39146"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-39152"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-39148"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-28491"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-39146"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-39140"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-39149"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-39147"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-39145"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-39154"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-28491"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-39141"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9488"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://security-tracker.debian.org/tracker/apache-log4j2"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#930724"
},
{
"db": "VULHUB",
"id": "VHN-407408"
},
{
"db": "PACKETSTORM",
"id": "165293"
},
{
"db": "PACKETSTORM",
"id": "165286"
},
{
"db": "PACKETSTORM",
"id": "165290"
},
{
"db": "PACKETSTORM",
"id": "165291"
},
{
"db": "PACKETSTORM",
"id": "165324"
},
{
"db": "PACKETSTORM",
"id": "165329"
},
{
"db": "PACKETSTORM",
"id": "165333"
},
{
"db": "PACKETSTORM",
"id": "165348"
},
{
"db": "PACKETSTORM",
"id": "165260"
},
{
"db": "PACKETSTORM",
"id": "165733"
},
{
"db": "PACKETSTORM",
"id": "169172"
},
{
"db": "CNNVD",
"id": "CNNVD-202112-799"
},
{
"db": "NVD",
"id": "CVE-2021-44228"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#930724"
},
{
"db": "VULHUB",
"id": "VHN-407408"
},
{
"db": "PACKETSTORM",
"id": "165293"
},
{
"db": "PACKETSTORM",
"id": "165286"
},
{
"db": "PACKETSTORM",
"id": "165290"
},
{
"db": "PACKETSTORM",
"id": "165291"
},
{
"db": "PACKETSTORM",
"id": "165324"
},
{
"db": "PACKETSTORM",
"id": "165329"
},
{
"db": "PACKETSTORM",
"id": "165333"
},
{
"db": "PACKETSTORM",
"id": "165348"
},
{
"db": "PACKETSTORM",
"id": "165260"
},
{
"db": "PACKETSTORM",
"id": "165733"
},
{
"db": "PACKETSTORM",
"id": "169172"
},
{
"db": "CNNVD",
"id": "CNNVD-202112-799"
},
{
"db": "NVD",
"id": "CVE-2021-44228"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-12-15T00:00:00",
"db": "CERT/CC",
"id": "VU#930724"
},
{
"date": "2021-12-10T00:00:00",
"db": "VULHUB",
"id": "VHN-407408"
},
{
"date": "2021-12-15T15:24:58",
"db": "PACKETSTORM",
"id": "165293"
},
{
"date": "2021-12-15T15:20:33",
"db": "PACKETSTORM",
"id": "165286"
},
{
"date": "2021-12-15T15:23:24",
"db": "PACKETSTORM",
"id": "165290"
},
{
"date": "2021-12-15T15:23:37",
"db": "PACKETSTORM",
"id": "165291"
},
{
"date": "2021-12-16T15:20:38",
"db": "PACKETSTORM",
"id": "165324"
},
{
"date": "2021-12-16T15:25:46",
"db": "PACKETSTORM",
"id": "165329"
},
{
"date": "2021-12-16T15:34:27",
"db": "PACKETSTORM",
"id": "165333"
},
{
"date": "2021-12-17T14:06:52",
"db": "PACKETSTORM",
"id": "165348"
},
{
"date": "2021-12-14T15:27:58",
"db": "PACKETSTORM",
"id": "165260"
},
{
"date": "2022-01-27T14:23:56",
"db": "PACKETSTORM",
"id": "165733"
},
{
"date": "2021-12-28T20:12:00",
"db": "PACKETSTORM",
"id": "169172"
},
{
"date": "2021-12-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202112-799"
},
{
"date": "2021-12-10T10:15:09.143000",
"db": "NVD",
"id": "CVE-2021-44228"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-02-07T00:00:00",
"db": "CERT/CC",
"id": "VU#930724"
},
{
"date": "2023-02-06T00:00:00",
"db": "VULHUB",
"id": "VHN-407408"
},
{
"date": "2023-04-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202112-799"
},
{
"date": "2023-11-07T03:39:36.897000",
"db": "NVD",
"id": "CVE-2021-44228"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "165348"
},
{
"db": "PACKETSTORM",
"id": "165260"
},
{
"db": "CNNVD",
"id": "CNNVD-202112-799"
}
],
"trust": 0.8
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apache Log4j allows insecure JNDI lookups",
"sources": [
{
"db": "CERT/CC",
"id": "VU#930724"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "code execution",
"sources": [
{
"db": "PACKETSTORM",
"id": "165293"
},
{
"db": "PACKETSTORM",
"id": "165286"
},
{
"db": "PACKETSTORM",
"id": "165290"
},
{
"db": "PACKETSTORM",
"id": "165291"
},
{
"db": "PACKETSTORM",
"id": "165329"
},
{
"db": "PACKETSTORM",
"id": "165333"
},
{
"db": "PACKETSTORM",
"id": "165260"
},
{
"db": "PACKETSTORM",
"id": "165733"
}
],
"trust": 0.8
}
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.