{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AMQ Streams 2.5.0 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat AMQ Streams, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency.\n\nSecurity Fix(es):\n\n* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)\n \n* scala: deserialization gadget chain (CVE-2022-36944)\n\n* DoS of the Okio client when handling a crafted GZIP archive (CVE-2023-3635)\n \n* netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data (CVE-2021-37136)\n\n* netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)\n\n* netty: world readable temporary file containing sensitive data (CVE-2022-24823)\n\n* guava: insecure temporary directory creation (CVE-2023-2976)\n\n* Jetty servlets with multipart support may cause OOM error with client requests (CVE-2023-26048)\n\n* Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies (CVE-2023-26049)\n\n* bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)\n\n* snappy-java: Integer overflow in shuffle leads to DoS (CVE-2023-34453)\n\n* snappy-java: Integer overflow in compress leads to DoS (CVE-2023-34454)\n\n* snappy-java: Unchecked chunk length leads to DoS (CVE-2023-34455)\n\n* Flaw in Netty\u0027s SniHandler while navigating TLS handshake; DoS (CVE-2023-34462)\n\n* RESTEasy: creation of insecure temp files (CVE-2023-0482)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:5165",
        "url": "https://access.redhat.com/errata/RHSA-2023:5165"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.streams\u0026version=2.5.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.streams\u0026version=2.5.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_amq_streams/2.5",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_amq_streams/2.5"
      },
      {
        "category": "external",
        "summary": "2004133",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004133"
      },
      {
        "category": "external",
        "summary": "2004135",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004135"
      },
      {
        "category": "external",
        "summary": "2087186",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2087186"
      },
      {
        "category": "external",
        "summary": "2129809",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129809"
      },
      {
        "category": "external",
        "summary": "2150009",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009"
      },
      {
        "category": "external",
        "summary": "2166004",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166004"
      },
      {
        "category": "external",
        "summary": "2215229",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215229"
      },
      {
        "category": "external",
        "summary": "2215393",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215393"
      },
      {
        "category": "external",
        "summary": "2215394",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215394"
      },
      {
        "category": "external",
        "summary": "2215445",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215445"
      },
      {
        "category": "external",
        "summary": "2215465",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465"
      },
      {
        "category": "external",
        "summary": "2216888",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216888"
      },
      {
        "category": "external",
        "summary": "2229295",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2229295"
      },
      {
        "category": "external",
        "summary": "2236340",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2236340"
      },
      {
        "category": "external",
        "summary": "2236341",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2236341"
      },
      {
        "category": "external",
        "summary": "ENTMQST-5081",
        "url": "https://issues.redhat.com/browse/ENTMQST-5081"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5165.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AMQ Streams 2.5.0 release and security update",
    "tracking": {
      "current_release_date": "2024-12-17T23:02:10+00:00",
      "generator": {
        "date": "2024-12-17T23:02:10+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2023:5165",
      "initial_release_date": "2023-09-14T09:51:43+00:00",
      "revision_history": [
        {
          "date": "2023-09-14T09:51:43+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-09-14T09:51:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-17T23:02:10+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat AMQ Streams 2.5.0",
                "product": {
                  "name": "Red Hat AMQ Streams 2.5.0",
                  "product_id": "Red Hat AMQ Streams 2.5.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:amq_streams:2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Streams for Apache Kafka"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-37136",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-09-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2004133"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In the OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack ship the vulnerable version of netty-codec package. Since the release of OCP 4.6, the Metering product has been deprecated [1], so the affected components are marked as wontfix. This may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 2.5.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "RHBZ#2004133",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004133"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37136",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv"
        }
      ],
      "release_date": "2021-09-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-14T09:51:43+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:5165"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data"
    },
    {
      "cve": "CVE-2021-37137",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-09-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2004135"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Netty\u0027s netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec package.\nSince the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected components are marked as wontfix.\nThis may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 2.5.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "RHBZ#2004135",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004135"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37137",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv"
        }
      ],
      "release_date": "2021-09-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-14T09:51:43+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:5165"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way"
    },
    {
      "cve": "CVE-2022-1471",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2022-12-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2150009"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "SnakeYaml: Constructor Deserialization Remote Code Execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 2.5.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-1471"
        },
        {
          "category": "external",
          "summary": "RHBZ#2150009",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471"
        },
        {
          "category": "external",
          "summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2",
          "url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2"
        }
      ],
      "release_date": "2022-10-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-14T09:51:43+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:5165"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "SnakeYaml: Constructor Deserialization Remote Code Execution"
    },
    {
      "cve": "CVE-2022-24823",
      "cwe": {
        "id": "CWE-379",
        "name": "Creation of Temporary File in Directory with Insecure Permissions"
      },
      "discovery_date": "2022-05-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2087186"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: world readable temporary file containing sensitive data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.\n\nRed Hat Satellite 6 is not affected as is using netty 3.6.7 version which is not impacted by this vulnerability.\n\nRed Hat Fuse 7 is now in Maintenance Support Phase and should be fixed soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 2.5.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-24823"
        },
        {
          "category": "external",
          "summary": "RHBZ#2087186",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2087186"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24823",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-24823"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24823",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24823"
        }
      ],
      "release_date": "2022-05-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-14T09:51:43+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:5165"
        },
        {
          "category": "workaround",
          "details": "As a workaround, specify one\u0027s own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty: world readable temporary file containing sensitive data"
    },
    {
      "cve": "CVE-2022-36944",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2022-09-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2129809"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Scala\u0027s LazyList that permits code execution during deserialization. This issue could allow an attacker to craft a LazyList containing a malicious Function0 call to execute arbitrary code on a server that deserializes untrusted data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "scala: deserialization gadget chain",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 2.5.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-36944"
        },
        {
          "category": "external",
          "summary": "RHBZ#2129809",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129809"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36944",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-36944"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36944",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36944"
        },
        {
          "category": "external",
          "summary": "https://github.com/scala/scala/pull/10118",
          "url": "https://github.com/scala/scala/pull/10118"
        }
      ],
      "release_date": "2022-09-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-14T09:51:43+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:5165"
        },
        {
          "category": "workaround",
          "details": "Users of Scala\u0027s LazyList should never permit deserialization of untrusted data.",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "scala: deserialization gadget chain"
    },
    {
      "cve": "CVE-2023-0482",
      "cwe": {
        "id": "CWE-378",
        "name": "Creation of Temporary File With Insecure Permissions"
      },
      "discovery_date": "2023-01-31T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2166004"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "RESTEasy: creation of insecure temp files",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 2.5.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-0482"
        },
        {
          "category": "external",
          "summary": "RHBZ#2166004",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166004"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0482",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-0482"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0482",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0482"
        }
      ],
      "release_date": "2023-01-31T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-14T09:51:43+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:5165"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "RESTEasy: creation of insecure temp files"
    },
    {
      "cve": "CVE-2023-2976",
      "cwe": {
        "id": "CWE-552",
        "name": "Files or Directories Accessible to External Parties"
      },
      "discovery_date": "2023-06-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2215229"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "guava: insecure temporary directory creation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Single Sign-On 7 ships the affected component as a layered product of Red Hat JBoss Enterprise Application 7, and as such is affected by this flaw. However, Single Sign-On 7 does not use the affected code and is not vulnerable to exploit.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 2.5.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-2976"
        },
        {
          "category": "external",
          "summary": "RHBZ#2215229",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215229"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-2976",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-2976"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976"
        }
      ],
      "release_date": "2023-06-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-14T09:51:43+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:5165"
        },
        {
          "category": "workaround",
          "details": "Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder.",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "guava: insecure temporary directory creation"
    },
    {
      "cve": "CVE-2023-3635",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2023-07-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2229295"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in SquareUp Okio. A class GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This issue may allow a malicious user to start processing a malformed file, which can result in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "okio: GzipSource class improper exception handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat JBoss Enterprise Application Platform XP does contain Okio package but is not using GzipSource.java, which is the affected class.\nRed Hat support for Spring Boot is considered low impact as it\u0027s used by Dekorate during compilation process and not included in the resulting Jar.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 2.5.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-3635"
        },
        {
          "category": "external",
          "summary": "RHBZ#2229295",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2229295"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-3635",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-3635"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-3635",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3635"
        }
      ],
      "release_date": "2023-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-14T09:51:43+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:5165"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "okio: GzipSource class improper exception handling"
    },
    {
      "cve": "CVE-2023-26048",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2023-08-30T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2236340"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the jetty-server package. A servlet with multipart support could get an OutOfMemorryError when the client sends a part that has a name but no filename and substantial content. This flaw allows a malicious user to jeopardize the environment by leaving the JVM in an unreliable state.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 2.5.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-26048"
        },
        {
          "category": "external",
          "summary": "RHBZ#2236340",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2236340"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-26048",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-26048"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-26048",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26048"
        },
        {
          "category": "external",
          "summary": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-qw69-rqj8-6qw8",
          "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-qw69-rqj8-6qw8"
        }
      ],
      "release_date": "2023-04-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-14T09:51:43+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:5165"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()"
    },
    {
      "cve": "CVE-2023-26049",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2023-08-30T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2236341"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the jetty-server package. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies or otherwise perform unintended behavior by tampering with the cookie parsing mechanism.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 2.5.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-26049"
        },
        {
          "category": "external",
          "summary": "RHBZ#2236341",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2236341"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-26049",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-26049"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-26049",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26049"
        },
        {
          "category": "external",
          "summary": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-p26g-97m4-6q7c",
          "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-p26g-97m4-6q7c"
        }
      ],
      "release_date": "2023-04-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-14T09:51:43+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:5165"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies"
    },
    {
      "cve": "CVE-2023-33201",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2023-06-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2215465"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bouncycastle: potential  blind LDAP injection attack using a self-signed certificate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 2.5.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-33201"
        },
        {
          "category": "external",
          "summary": "RHBZ#2215465",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215465"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-33201",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201",
          "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201"
        }
      ],
      "release_date": "2023-06-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-14T09:51:43+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:5165"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "bouncycastle: potential  blind LDAP injection attack using a self-signed certificate"
    },
    {
      "cve": "CVE-2023-34453",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2023-06-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2215393"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Snappy-java\u0027s shuffle function, which does not check input sizes before beginning operations. This issue could allow an attacker to send malicious input to trigger an overflow error that crashes the program, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "snappy-java: Integer overflow in shuffle leads to DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 2.5.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-34453"
        },
        {
          "category": "external",
          "summary": "RHBZ#2215393",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215393"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-34453",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-34453"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-34453",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34453"
        }
      ],
      "release_date": "2023-06-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-14T09:51:43+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:5165"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "snappy-java: Integer overflow in shuffle leads to DoS"
    },
    {
      "cve": "CVE-2023-34454",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2023-06-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2215394"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Snappy-java\u0027s shuffle function, which does not check input sizes before beginning operations. This issue could allow an attacker to send malicious input to trigger an overflow error that crashes the program, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "snappy-java: Integer overflow in compress leads to DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 2.5.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-34454"
        },
        {
          "category": "external",
          "summary": "RHBZ#2215394",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215394"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-34454",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-34454"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-34454",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34454"
        }
      ],
      "release_date": "2023-06-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-14T09:51:43+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:5165"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "snappy-java: Integer overflow in compress leads to DoS"
    },
    {
      "cve": "CVE-2023-34455",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2023-06-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2215445"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Snappy-java\u0027s fileSnappyInputStream hasNextChunk function, which does not sufficiently evaluate input bytes before beginning operations. This issue could allow an attacker to send malicious input to trigger an out of memory error that crashes the program, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "snappy-java: Unchecked chunk length leads to DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 2.5.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-34455"
        },
        {
          "category": "external",
          "summary": "RHBZ#2215445",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215445"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-34455",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-34455"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-34455",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34455"
        }
      ],
      "release_date": "2023-06-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-14T09:51:43+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:5165"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "snappy-java: Unchecked chunk length leads to DoS"
    },
    {
      "cve": "CVE-2023-34462",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2023-06-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2216888"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s SniHandler while navigating TLS handshake which may permit a large heap allocation if the handler did not have a timeout configured. This issue may allow an attacker to send a client hello packet which would cause the server to buffer large amounts of data per connection, potentially causing an out of memory error, resulting in Denial of Service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: SniHandler 16MB allocation leads to OOM",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 2.5.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-34462"
        },
        {
          "category": "external",
          "summary": "RHBZ#2216888",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2216888"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-34462",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-34462"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-34462",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34462"
        }
      ],
      "release_date": "2023-06-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-14T09:51:43+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:5165"
        },
        {
          "category": "workaround",
          "details": "Configuration of SniHandler with an idle timeout will mitigate this issue.",
          "product_ids": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 2.5.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty: SniHandler 16MB allocation leads to OOM"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for netty, netty-tcnative",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for netty, netty-tcnative fixes the following issues:\n\nnetty:\n\n- Security fixes included in this version update from 4.1.75 to 4.1.90:\n  * CVE-2022-24823: Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files for\n    Java 6 and lower in io.netty:netty-codec-http (bsc#1199338)\n  * CVE-2022-41881: HAProxyMessageDecoder Stack Exhaustion DoS (bsc#1206360)\n  * CVE-2022-41915: HTTP Response splitting from assigning header value iterator (bsc#1206379)\n    \n- Other non-security bug fixes included in this version update from 4.1.75 to 4.1.90:\n  * Build with Java 11 on ix86 architecture in order to avoid build failures \n  * Fix `HttpHeaders.names` for non-String headers\n  * Fix `FlowControlHandler` behaviour to pass read events when auto-reading is turned off\n  * Fix brotli compression\n  * Fix a bug in FlowControlHandler that broke auto-read\n  * Fix a potential memory leak bug has been in the pooled allocator\n  * Fix a scalability issue caused by instanceof and check-cast checks that lead to false-sharing on the \n    `Klass::secondary_super_cache` field in the JVM\n  * Fix a bug in our `PEMParser` when PEM files have multiple objects, and `BouncyCastle` is on the classpath\n  * Fix several `NullPointerException` bugs\n  * Fix a regression `SslContext` private key loading\n  * Fix a bug in `SslContext` private key reading fall-back path\n  * Fix a buffer leak regression in `HttpClientCodec`\n  * Fix a bug where some `HttpMessage` implementations, that also implement `HttpContent`, were not handled correctly\n  * Fix epoll bug when receiving zero-sized datagrams\n  * Fix a bug in `SslHandler` so `handlerRemoved` works properly even if `handlerAdded` throws an exception\n  * Fix an issue that allowed the multicast methods on `EpollDatagramChannel` to be called outside of an event-loop \n    thread\n  * Fix a bug where an OPT record was added to DNS queries that already had such a record\n  * Fix a bug that caused an error when files uploaded with HTTP POST contained a backslash in their name\n  * Fix an issue in the `BlockHound` integration that could occasionally cause NetUtil to be reported as performing\n    blocking operation. A similar `BlockHound` issue was fixed for the `JdkSslContext`\n  * Fix a bug that prevented preface or settings frames from being flushed, when an HTTP2 connection was established\n    with prior-knowledge\n  * Fix a bug where Netty fails to load a shaded native library\n  * Fix and relax overly strict HTTP/2 header validation check that was rejecting requests from Chrome and Firefox\n  * Fix OpenSSL and BoringSSL implementations to respect the `jdk.tls.client.protocols` and `jdk.tls.server.protocols`\n    system properties, making them react to these in the same way the JDK SSL provider does\n  * Fix inconsitencies in how `epoll`, `kqueue`, and `NIO` handle RDHUP\n  * For a more detailed list of changes please consult the official release notes:\n    +  Changes from 4.1.90: https://netty.io/news/2023/03/14/4-1-90-Final.html\n    +  Changes from 4.1.89: https://netty.io/news/2023/02/13/4-1-89-Final.html\n    +  Changes from 4.1.88: https://netty.io/news/2023/02/12/4-1-88-Final.html\n    +  Changes from 4.1.87: https://netty.io/news/2023/01/12/4-1-87-Final.html\n    +  Changes from 4.1.86: https://netty.io/news/2022/12/12/4-1-86-Final.html\n    +  Changes from 4.1.85: https://netty.io/news/2022/11/09/4-1-85-Final.html\n    +  Changes from 4.1.84: https://netty.io/news/2022/10/11/4-1-84-Final.html\n    +  Changes from 4.1.82: https://netty.io/news/2022/09/13/4-1-82-Final.html\n    +  Changes from 4.1.81: https://netty.io/news/2022/09/08/4-1-81-Final.html\n    +  Changes from 4.1.80: https://netty.io/news/2022/08/26/4-1-80-Final.html\n    +  Changes from 4.1.79: https://netty.io/news/2022/07/11/4-1-79-Final.html\n    +  Changes from 4.1.78: https://netty.io/news/2022/06/14/4-1-78-Final.html\n    +  Changes from 4.1.77: https://netty.io/news/2022/05/06/2-1-77-Final.html\n    +  Changes from 4.1.76: https://netty.io/news/2022/04/12/4-1-76-Final.html\n\nnetty-tcnative:\n    \n- New artifact named `netty-tcnative-classes`, provided by this update is required by netty 4.1.90 which contains \n  important security updates\n- No formal changelog present. This artifact is closely bound to the netty releases\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2023-2096,SUSE-SLE-Module-Development-Tools-15-SP4-2023-2096,SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-2096,SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-2096,SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-2096,SUSE-SLE-Product-RT-15-SP3-2023-2096,SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-2096,SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-2096,SUSE-SLE-Product-SLES_SAP-15-SP2-2023-2096,SUSE-SLE-Product-SLES_SAP-15-SP3-2023-2096,SUSE-Storage-7-2023-2096,SUSE-Storage-7.1-2023-2096,openSUSE-SLE-15.4-2023-2096",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_2096-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2023:2096-1",
        "url": "https://www.suse.com/support/update/announcement/2023/suse-su-20232096-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2023:2096-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-May/014770.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1199338",
        "url": "https://bugzilla.suse.com/1199338"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1206360",
        "url": "https://bugzilla.suse.com/1206360"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1206379",
        "url": "https://bugzilla.suse.com/1206379"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-24823 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-24823/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-41881 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-41881/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-41915 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-41915/"
      }
    ],
    "title": "Security update for netty, netty-tcnative",
    "tracking": {
      "current_release_date": "2023-05-04T07:09:25Z",
      "generator": {
        "date": "2023-05-04T07:09:25Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2023:2096-1",
      "initial_release_date": "2023-05-04T07:09:25Z",
      "revision_history": [
        {
          "date": "2023-05-04T07:09:25Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-4.1.90-150200.4.14.1.aarch64",
                "product": {
                  "name": "netty-4.1.90-150200.4.14.1.aarch64",
                  "product_id": "netty-4.1.90-150200.4.14.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-2.0.59-150200.3.10.1.aarch64",
                "product": {
                  "name": "netty-tcnative-2.0.59-150200.3.10.1.aarch64",
                  "product_id": "netty-tcnative-2.0.59-150200.3.10.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-4.1.90-150200.4.14.1.i586",
                "product": {
                  "name": "netty-4.1.90-150200.4.14.1.i586",
                  "product_id": "netty-4.1.90-150200.4.14.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-2.0.59-150200.3.10.1.i586",
                "product": {
                  "name": "netty-tcnative-2.0.59-150200.3.10.1.i586",
                  "product_id": "netty-tcnative-2.0.59-150200.3.10.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-javadoc-4.1.90-150200.4.14.1.noarch",
                "product": {
                  "name": "netty-javadoc-4.1.90-150200.4.14.1.noarch",
                  "product_id": "netty-javadoc-4.1.90-150200.4.14.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "netty-poms-4.1.90-150200.4.14.1.noarch",
                "product": {
                  "name": "netty-poms-4.1.90-150200.4.14.1.noarch",
                  "product_id": "netty-poms-4.1.90-150200.4.14.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch",
                "product": {
                  "name": "netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch",
                  "product_id": "netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-4.1.90-150200.4.14.1.ppc64le",
                "product": {
                  "name": "netty-4.1.90-150200.4.14.1.ppc64le",
                  "product_id": "netty-4.1.90-150200.4.14.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
                "product": {
                  "name": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
                  "product_id": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-4.1.90-150200.4.14.1.s390x",
                "product": {
                  "name": "netty-4.1.90-150200.4.14.1.s390x",
                  "product_id": "netty-4.1.90-150200.4.14.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-2.0.59-150200.3.10.1.s390x",
                "product": {
                  "name": "netty-tcnative-2.0.59-150200.3.10.1.s390x",
                  "product_id": "netty-tcnative-2.0.59-150200.3.10.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-4.1.90-150200.4.14.1.x86_64",
                "product": {
                  "name": "netty-4.1.90-150200.4.14.1.x86_64",
                  "product_id": "netty-4.1.90-150200.4.14.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
                "product": {
                  "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
                  "product_id": "netty-tcnative-2.0.59-150200.3.10.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Development Tools 15 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Development Tools 15 SP4",
                  "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-development-tools:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Real Time 15 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Real Time 15 SP3",
                  "product_id": "SUSE Linux Enterprise Real Time 15 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_rt:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Enterprise Storage 7",
                "product": {
                  "name": "SUSE Enterprise Storage 7",
                  "product_id": "SUSE Enterprise Storage 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:ses:7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Enterprise Storage 7.1",
                "product": {
                  "name": "SUSE Enterprise Storage 7.1",
                  "product_id": "SUSE Enterprise Storage 7.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:ses:7.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.4",
                "product": {
                  "name": "openSUSE Leap 15.4",
                  "product_id": "openSUSE Leap 15.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.aarch64 as component of SUSE Linux Enterprise Module for Development Tools 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.aarch64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le as component of SUSE Linux Enterprise Module for Development Tools 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.s390x as component of SUSE Linux Enterprise Module for Development Tools 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.s390x"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64 as component of SUSE Linux Enterprise Module for Development Tools 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.aarch64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64 as component of SUSE Linux Enterprise Real Time 15 SP3",
          "product_id": "SUSE Linux Enterprise Real Time 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Real Time 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.s390x as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.s390x as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.ppc64le"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.ppc64le"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.aarch64 as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.aarch64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.aarch64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64 as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.aarch64 as component of SUSE Enterprise Storage 7.1",
          "product_id": "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.aarch64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.aarch64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64 as component of SUSE Enterprise Storage 7.1",
          "product_id": "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.90-150200.4.14.1.aarch64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.aarch64"
        },
        "product_reference": "netty-4.1.90-150200.4.14.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.90-150200.4.14.1.ppc64le as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.ppc64le"
        },
        "product_reference": "netty-4.1.90-150200.4.14.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.90-150200.4.14.1.s390x as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.s390x"
        },
        "product_reference": "netty-4.1.90-150200.4.14.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.90-150200.4.14.1.x86_64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.x86_64"
        },
        "product_reference": "netty-4.1.90-150200.4.14.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-javadoc-4.1.90-150200.4.14.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:netty-javadoc-4.1.90-150200.4.14.1.noarch"
        },
        "product_reference": "netty-javadoc-4.1.90-150200.4.14.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-poms-4.1.90-150200.4.14.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:netty-poms-4.1.90-150200.4.14.1.noarch"
        },
        "product_reference": "netty-poms-4.1.90-150200.4.14.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.aarch64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.aarch64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.s390x as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.s390x"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
        },
        "product_reference": "netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-24823",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-24823"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty\u0027s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one\u0027s own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Real Time 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.aarch64",
          "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.ppc64le",
          "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.s390x",
          "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.x86_64",
          "openSUSE Leap 15.4:netty-javadoc-4.1.90-150200.4.14.1.noarch",
          "openSUSE Leap 15.4:netty-poms-4.1.90-150200.4.14.1.noarch",
          "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "openSUSE Leap 15.4:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-24823",
          "url": "https://www.suse.com/security/cve/CVE-2022-24823"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1199338 for CVE-2022-24823",
          "url": "https://bugzilla.suse.com/1199338"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.aarch64",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.ppc64le",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.s390x",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.x86_64",
            "openSUSE Leap 15.4:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.4:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.4:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.aarch64",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.ppc64le",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.s390x",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.x86_64",
            "openSUSE Leap 15.4:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.4:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.4:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-05-04T07:09:25Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-24823"
    },
    {
      "cve": "CVE-2022-41881",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-41881"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Real Time 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.aarch64",
          "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.ppc64le",
          "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.s390x",
          "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.x86_64",
          "openSUSE Leap 15.4:netty-javadoc-4.1.90-150200.4.14.1.noarch",
          "openSUSE Leap 15.4:netty-poms-4.1.90-150200.4.14.1.noarch",
          "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "openSUSE Leap 15.4:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-41881",
          "url": "https://www.suse.com/security/cve/CVE-2022-41881"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1206360 for CVE-2022-41881",
          "url": "https://bugzilla.suse.com/1206360"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.aarch64",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.ppc64le",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.s390x",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.x86_64",
            "openSUSE Leap 15.4:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.4:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.4:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.aarch64",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.ppc64le",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.s390x",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.x86_64",
            "openSUSE Leap 15.4:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.4:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.4:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-05-04T07:09:25Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-41881"
    },
    {
      "cve": "CVE-2022-41915",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-41915"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator\u003c?\u003e)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Real Time 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.aarch64",
          "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.ppc64le",
          "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.s390x",
          "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.x86_64",
          "openSUSE Leap 15.4:netty-javadoc-4.1.90-150200.4.14.1.noarch",
          "openSUSE Leap 15.4:netty-poms-4.1.90-150200.4.14.1.noarch",
          "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "openSUSE Leap 15.4:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-41915",
          "url": "https://www.suse.com/security/cve/CVE-2022-41915"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1206379 for CVE-2022-41915",
          "url": "https://bugzilla.suse.com/1206379"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.aarch64",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.ppc64le",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.s390x",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.x86_64",
            "openSUSE Leap 15.4:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.4:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.4:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Enterprise Storage 7.1:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Enterprise Storage 7:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.aarch64",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.ppc64le",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.s390x",
            "openSUSE Leap 15.4:netty-4.1.90-150200.4.14.1.x86_64",
            "openSUSE Leap 15.4:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.4:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "openSUSE Leap 15.4:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.4:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-05-04T07:09:25Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-41915"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for netty, netty-tcnative",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for netty, netty-tcnative fixes the following issues:\n\nnetty:\n\n- Security fixes included in this version update from 4.1.75 to 4.1.90:\n  * CVE-2022-24823: Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files for\n    Java 6 and lower in io.netty:netty-codec-http (bsc#1199338)\n  * CVE-2022-41881: HAProxyMessageDecoder Stack Exhaustion DoS (bsc#1206360)\n  * CVE-2022-41915: HTTP Response splitting from assigning header value iterator (bsc#1206379)\n    \n- Other non-security bug fixes included in this version update from 4.1.75 to 4.1.90:\n  * Build with Java 11 on ix86 architecture in order to avoid build failures \n  * Fix `HttpHeaders.names` for non-String headers\n  * Fix `FlowControlHandler` behaviour to pass read events when auto-reading is turned off\n  * Fix brotli compression\n  * Fix a bug in FlowControlHandler that broke auto-read\n  * Fix a potential memory leak bug has been in the pooled allocator\n  * Fix a scalability issue caused by instanceof and check-cast checks that lead to false-sharing on the \n    `Klass::secondary_super_cache` field in the JVM\n  * Fix a bug in our `PEMParser` when PEM files have multiple objects, and `BouncyCastle` is on the classpath\n  * Fix several `NullPointerException` bugs\n  * Fix a regression `SslContext` private key loading\n  * Fix a bug in `SslContext` private key reading fall-back path\n  * Fix a buffer leak regression in `HttpClientCodec`\n  * Fix a bug where some `HttpMessage` implementations, that also implement `HttpContent`, were not handled correctly\n  * Fix epoll bug when receiving zero-sized datagrams\n  * Fix a bug in `SslHandler` so `handlerRemoved` works properly even if `handlerAdded` throws an exception\n  * Fix an issue that allowed the multicast methods on `EpollDatagramChannel` to be called outside of an event-loop \n    thread\n  * Fix a bug where an OPT record was added to DNS queries that already had such a record\n  * Fix a bug that caused an error when files uploaded with HTTP POST contained a backslash in their name\n  * Fix an issue in the `BlockHound` integration that could occasionally cause NetUtil to be reported as performing\n    blocking operation. A similar `BlockHound` issue was fixed for the `JdkSslContext`\n  * Fix a bug that prevented preface or settings frames from being flushed, when an HTTP2 connection was established\n    with prior-knowledge\n  * Fix a bug where Netty fails to load a shaded native library\n  * Fix and relax overly strict HTTP/2 header validation check that was rejecting requests from Chrome and Firefox\n  * Fix OpenSSL and BoringSSL implementations to respect the `jdk.tls.client.protocols` and `jdk.tls.server.protocols`\n    system properties, making them react to these in the same way the JDK SSL provider does\n  * Fix inconsitencies in how `epoll`, `kqueue`, and `NIO` handle RDHUP\n  * For a more detailed list of changes please consult the official release notes:\n    +  Changes from 4.1.90: https://netty.io/news/2023/03/14/4-1-90-Final.html\n    +  Changes from 4.1.89: https://netty.io/news/2023/02/13/4-1-89-Final.html\n    +  Changes from 4.1.88: https://netty.io/news/2023/02/12/4-1-88-Final.html\n    +  Changes from 4.1.87: https://netty.io/news/2023/01/12/4-1-87-Final.html\n    +  Changes from 4.1.86: https://netty.io/news/2022/12/12/4-1-86-Final.html\n    +  Changes from 4.1.85: https://netty.io/news/2022/11/09/4-1-85-Final.html\n    +  Changes from 4.1.84: https://netty.io/news/2022/10/11/4-1-84-Final.html\n    +  Changes from 4.1.82: https://netty.io/news/2022/09/13/4-1-82-Final.html\n    +  Changes from 4.1.81: https://netty.io/news/2022/09/08/4-1-81-Final.html\n    +  Changes from 4.1.80: https://netty.io/news/2022/08/26/4-1-80-Final.html\n    +  Changes from 4.1.79: https://netty.io/news/2022/07/11/4-1-79-Final.html\n    +  Changes from 4.1.78: https://netty.io/news/2022/06/14/4-1-78-Final.html\n    +  Changes from 4.1.77: https://netty.io/news/2022/05/06/2-1-77-Final.html\n    +  Changes from 4.1.76: https://netty.io/news/2022/04/12/4-1-76-Final.html\n\nnetty-tcnative:\n    \n- New artifact named `netty-tcnative-classes`, provided by this update is required by netty 4.1.90 which contains \n  important security updates\n- No formal changelog present. This artifact is closely bound to the netty releases\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2023-2096,SUSE-SLE-Module-Development-Tools-15-SP5-2023-2096,SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-2096,openSUSE-SLE-15.5-2023-2096",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_2096-2.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2023:2096-2",
        "url": "https://www.suse.com/support/update/announcement/2023/suse-su-20232096-2/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2023:2096-2",
        "url": "https://lists.suse.com/pipermail/sle-updates/2023-June/029968.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1199338",
        "url": "https://bugzilla.suse.com/1199338"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1206360",
        "url": "https://bugzilla.suse.com/1206360"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1206379",
        "url": "https://bugzilla.suse.com/1206379"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-24823 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-24823/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-41881 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-41881/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-41915 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-41915/"
      }
    ],
    "title": "Security update for netty, netty-tcnative",
    "tracking": {
      "current_release_date": "2023-06-21T10:37:18Z",
      "generator": {
        "date": "2023-06-21T10:37:18Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2023:2096-2",
      "initial_release_date": "2023-06-21T10:37:18Z",
      "revision_history": [
        {
          "date": "2023-06-21T10:37:18Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-4.1.90-150200.4.14.1.aarch64",
                "product": {
                  "name": "netty-4.1.90-150200.4.14.1.aarch64",
                  "product_id": "netty-4.1.90-150200.4.14.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-2.0.59-150200.3.10.1.aarch64",
                "product": {
                  "name": "netty-tcnative-2.0.59-150200.3.10.1.aarch64",
                  "product_id": "netty-tcnative-2.0.59-150200.3.10.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-4.1.90-150200.4.14.1.i586",
                "product": {
                  "name": "netty-4.1.90-150200.4.14.1.i586",
                  "product_id": "netty-4.1.90-150200.4.14.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-2.0.59-150200.3.10.1.i586",
                "product": {
                  "name": "netty-tcnative-2.0.59-150200.3.10.1.i586",
                  "product_id": "netty-tcnative-2.0.59-150200.3.10.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-javadoc-4.1.90-150200.4.14.1.noarch",
                "product": {
                  "name": "netty-javadoc-4.1.90-150200.4.14.1.noarch",
                  "product_id": "netty-javadoc-4.1.90-150200.4.14.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "netty-poms-4.1.90-150200.4.14.1.noarch",
                "product": {
                  "name": "netty-poms-4.1.90-150200.4.14.1.noarch",
                  "product_id": "netty-poms-4.1.90-150200.4.14.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch",
                "product": {
                  "name": "netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch",
                  "product_id": "netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-4.1.90-150200.4.14.1.ppc64le",
                "product": {
                  "name": "netty-4.1.90-150200.4.14.1.ppc64le",
                  "product_id": "netty-4.1.90-150200.4.14.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
                "product": {
                  "name": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
                  "product_id": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-4.1.90-150200.4.14.1.s390x",
                "product": {
                  "name": "netty-4.1.90-150200.4.14.1.s390x",
                  "product_id": "netty-4.1.90-150200.4.14.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-2.0.59-150200.3.10.1.s390x",
                "product": {
                  "name": "netty-tcnative-2.0.59-150200.3.10.1.s390x",
                  "product_id": "netty-tcnative-2.0.59-150200.3.10.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-4.1.90-150200.4.14.1.x86_64",
                "product": {
                  "name": "netty-4.1.90-150200.4.14.1.x86_64",
                  "product_id": "netty-4.1.90-150200.4.14.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
                "product": {
                  "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
                  "product_id": "netty-tcnative-2.0.59-150200.3.10.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Development Tools 15 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Development Tools 15 SP5",
                  "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-development-tools:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Package Hub 15 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Package Hub 15 SP5",
                  "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:packagehub:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.5",
                "product": {
                  "name": "openSUSE Leap 15.5",
                  "product_id": "openSUSE Leap 15.5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.aarch64 as component of SUSE Linux Enterprise Module for Development Tools 15 SP5",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.aarch64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le as component of SUSE Linux Enterprise Module for Development Tools 15 SP5",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.s390x as component of SUSE Linux Enterprise Module for Development Tools 15 SP5",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.s390x"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64 as component of SUSE Linux Enterprise Module for Development Tools 15 SP5",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.90-150200.4.14.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP5",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.aarch64"
        },
        "product_reference": "netty-4.1.90-150200.4.14.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.90-150200.4.14.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP5",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.ppc64le"
        },
        "product_reference": "netty-4.1.90-150200.4.14.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.90-150200.4.14.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP5",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.s390x"
        },
        "product_reference": "netty-4.1.90-150200.4.14.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.90-150200.4.14.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP5",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.x86_64"
        },
        "product_reference": "netty-4.1.90-150200.4.14.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-javadoc-4.1.90-150200.4.14.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP5",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-javadoc-4.1.90-150200.4.14.1.noarch"
        },
        "product_reference": "netty-javadoc-4.1.90-150200.4.14.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-poms-4.1.90-150200.4.14.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP5",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-poms-4.1.90-150200.4.14.1.noarch"
        },
        "product_reference": "netty-poms-4.1.90-150200.4.14.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.90-150200.4.14.1.aarch64 as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.aarch64"
        },
        "product_reference": "netty-4.1.90-150200.4.14.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.90-150200.4.14.1.ppc64le as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.ppc64le"
        },
        "product_reference": "netty-4.1.90-150200.4.14.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.90-150200.4.14.1.s390x as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.s390x"
        },
        "product_reference": "netty-4.1.90-150200.4.14.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.90-150200.4.14.1.x86_64 as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.x86_64"
        },
        "product_reference": "netty-4.1.90-150200.4.14.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-javadoc-4.1.90-150200.4.14.1.noarch as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:netty-javadoc-4.1.90-150200.4.14.1.noarch"
        },
        "product_reference": "netty-javadoc-4.1.90-150200.4.14.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-poms-4.1.90-150200.4.14.1.noarch as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:netty-poms-4.1.90-150200.4.14.1.noarch"
        },
        "product_reference": "netty-poms-4.1.90-150200.4.14.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.aarch64 as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.aarch64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.s390x as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.s390x"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.59-150200.3.10.1.x86_64 as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.59-150200.3.10.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
        },
        "product_reference": "netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-24823",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-24823"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty\u0027s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one\u0027s own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-poms-4.1.90-150200.4.14.1.noarch",
          "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.aarch64",
          "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.ppc64le",
          "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.s390x",
          "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.x86_64",
          "openSUSE Leap 15.5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
          "openSUSE Leap 15.5:netty-poms-4.1.90-150200.4.14.1.noarch",
          "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "openSUSE Leap 15.5:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-24823",
          "url": "https://www.suse.com/security/cve/CVE-2022-24823"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1199338 for CVE-2022-24823",
          "url": "https://bugzilla.suse.com/1199338"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.aarch64",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.ppc64le",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.s390x",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.x86_64",
            "openSUSE Leap 15.5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.5:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.aarch64",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.ppc64le",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.s390x",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.x86_64",
            "openSUSE Leap 15.5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.5:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-06-21T10:37:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-24823"
    },
    {
      "cve": "CVE-2022-41881",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-41881"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-poms-4.1.90-150200.4.14.1.noarch",
          "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.aarch64",
          "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.ppc64le",
          "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.s390x",
          "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.x86_64",
          "openSUSE Leap 15.5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
          "openSUSE Leap 15.5:netty-poms-4.1.90-150200.4.14.1.noarch",
          "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "openSUSE Leap 15.5:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-41881",
          "url": "https://www.suse.com/security/cve/CVE-2022-41881"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1206360 for CVE-2022-41881",
          "url": "https://bugzilla.suse.com/1206360"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.aarch64",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.ppc64le",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.s390x",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.x86_64",
            "openSUSE Leap 15.5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.5:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.aarch64",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.ppc64le",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.s390x",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.x86_64",
            "openSUSE Leap 15.5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.5:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-06-21T10:37:18Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-41881"
    },
    {
      "cve": "CVE-2022-41915",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-41915"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator\u003c?\u003e)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-poms-4.1.90-150200.4.14.1.noarch",
          "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.aarch64",
          "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.ppc64le",
          "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.s390x",
          "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.x86_64",
          "openSUSE Leap 15.5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
          "openSUSE Leap 15.5:netty-poms-4.1.90-150200.4.14.1.noarch",
          "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
          "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
          "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
          "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
          "openSUSE Leap 15.5:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-41915",
          "url": "https://www.suse.com/security/cve/CVE-2022-41915"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1206379 for CVE-2022-41915",
          "url": "https://bugzilla.suse.com/1206379"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.aarch64",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.ppc64le",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.s390x",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.x86_64",
            "openSUSE Leap 15.5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.5:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-4.1.90-150200.4.14.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.aarch64",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.ppc64le",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.s390x",
            "openSUSE Leap 15.5:netty-4.1.90-150200.4.14.1.x86_64",
            "openSUSE Leap 15.5:netty-javadoc-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-poms-4.1.90-150200.4.14.1.noarch",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.aarch64",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.ppc64le",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.s390x",
            "openSUSE Leap 15.5:netty-tcnative-2.0.59-150200.3.10.1.x86_64",
            "openSUSE Leap 15.5:netty-tcnative-javadoc-2.0.59-150200.3.10.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-06-21T10:37:18Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-41915"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Tivoli Netcool/OMNIbus ist eine Software zum Betriebsmanagement von IBM.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler Angreifer kann eine Schwachstelle in IBM Tivoli Netcool/OMNIbus ausnutzen, um Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX\n- Linux\n- Windows\n- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-0508 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0508.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-0508 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0508"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7030939 vom 2023-09-07",
        "url": "https://www.ibm.com/support/pages/node/7030939"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin: 6594755 vom 2022-06-29",
        "url": "https://www.ibm.com/support/pages/node/6594755"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM Tivoli Netcool/OMNIbus: Schwachstelle erm\u00f6glicht Offenlegung von Informationen",
    "tracking": {
      "current_release_date": "2023-09-07T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:29:35.568+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2022-0508",
      "initial_release_date": "2022-06-29T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-06-29T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-09-07T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von IBM aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM Maximo Asset Management 7.6.1.2",
            "product": {
              "name": "IBM Maximo Asset Management 7.6.1.2",
              "product_id": "812526",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:maximo_asset_management:7.6.1.2"
              }
            }
          },
          {
            "category": "product_name",
            "name": "IBM Tivoli Netcool/OMNIbus 8.1.0",
            "product": {
              "name": "IBM Tivoli Netcool/OMNIbus 8.1.0",
              "product_id": "700367",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:tivoli_netcool%2fomnibus:8.1.0"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-24823",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in IBM Tivoli Netcool/OMNIbus. Der Fehler besteht in der \"Transport Module Common Integration Library\" und ist dort auf ein Problem mit der Komponente \"Netty\" zur\u00fcckzuf\u00fchren. Hier kann eine ungewollte Speicherung von Daten in den temp. Ordner geschehen, welche dann offengelegt werden k\u00f6nnen. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "700367",
          "812526"
        ]
      },
      "release_date": "2022-06-29T22:00:00.000+00:00",
      "title": "CVE-2022-24823"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "JBoss Enterprise Application Platform ist eine skalierbare Plattform f\u00fcr Java-Anwendungen, inklusive JBoss Application Server, JBoss Hibernate und Boss Seam.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um die Vertraulichkeit, die Verf\u00fcgbarkeit und die Integrit\u00e4t zu gef\u00e4hrden, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-0901 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0901.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-0901 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0901"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:5892 vom 2022-08-03",
        "url": "https://access.redhat.com/errata/RHSA-2022:5892"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:5893 vom 2022-08-03",
        "url": "https://access.redhat.com/errata/RHSA-2022:5893"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:5894 vom 2022-08-03",
        "url": "https://access.redhat.com/errata/RHSA-2022:5894"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:5928 vom 2022-08-09",
        "url": "https://access.redhat.com/errata/RHSA-2022:5928"
      },
      {
        "category": "external",
        "summary": "JFrog Fixed Security Vulnerabilities",
        "url": "https://www.jfrog.com/confluence/display/JFROG/Fixed+Security+Vulnerabilities"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6819 vom 2022-10-05",
        "url": "https://access.redhat.com/errata/RHSA-2022:6819"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6916 vom 2022-10-12",
        "url": "https://access.redhat.com/errata/RHSA-2022:6916"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:8524 vom 2022-11-17",
        "url": "https://access.redhat.com/errata/RHSA-2022:8524"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:8652 vom 2022-11-28",
        "url": "https://access.redhat.com/errata/RHSA-2022:8652"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:0612 vom 2023-02-06",
        "url": "https://access.redhat.com/errata/RHSA-2023:0612"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:1747 vom 2025-02-24",
        "url": "https://access.redhat.com/errata/RHSA-2025:1747"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:4226 vom 2025-04-28",
        "url": "https://access.redhat.com/errata/RHSA-2025:4226"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:4437 vom 2025-05-05",
        "url": "https://access.redhat.com/errata/RHSA-2025:4437"
      }
    ],
    "source_lang": "en-US",
    "title": "Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-05-04T22:00:00.000+00:00",
      "generator": {
        "date": "2025-05-05T08:09:19.940+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.12"
        }
      },
      "id": "WID-SEC-W-2022-0901",
      "initial_release_date": "2022-08-03T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-08-03T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2022-08-08T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-10-03T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2022-10-05T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-10-12T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-11-17T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-11-28T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-02-06T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-02-23T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-04-27T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-05-04T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "11"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.46.3",
                "product": {
                  "name": "JFrog Artifactory \u003c7.46.3",
                  "product_id": "T024764"
                }
              },
              {
                "category": "product_version",
                "name": "7.46.3",
                "product": {
                  "name": "JFrog Artifactory 7.46.3",
                  "product_id": "T024764-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:jfrog:artifactory:7.46.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Artifactory"
          }
        ],
        "category": "vendor",
        "name": "JFrog"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.4.6",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform \u003c7.4.6",
                  "product_id": "130262"
                }
              },
              {
                "category": "product_version",
                "name": "7.4.6",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 7.4.6",
                  "product_id": "130262-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:4.2.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.3.12",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform \u003c7.3.12",
                  "product_id": "T041369"
                }
              },
              {
                "category": "product_version",
                "name": "7.3.12",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 7.3.12",
                  "product_id": "T041369-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.3.12"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.3.13",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform \u003c7.3.13",
                  "product_id": "T043288"
                }
              },
              {
                "category": "product_version",
                "name": "7.3.13",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 7.3.13",
                  "product_id": "T043288-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.3.13"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-44906",
      "product_status": {
        "known_affected": [
          "130262",
          "67646",
          "T024764",
          "T041369",
          "T043288"
        ]
      },
      "release_date": "2022-08-03T22:00:00.000+00:00",
      "title": "CVE-2021-44906"
    },
    {
      "cve": "CVE-2022-25647",
      "product_status": {
        "known_affected": [
          "130262",
          "67646",
          "T024764",
          "T041369",
          "T043288"
        ]
      },
      "release_date": "2022-08-03T22:00:00.000+00:00",
      "title": "CVE-2022-25647"
    },
    {
      "cve": "CVE-2022-24823",
      "product_status": {
        "known_affected": [
          "130262",
          "67646",
          "T024764",
          "T041369",
          "T043288"
        ]
      },
      "release_date": "2022-08-03T22:00:00.000+00:00",
      "title": "CVE-2022-24823"
    }
  ]
}