{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SINEC NMS before V2.0 SP1 is affected by multiple vulnerabilities.\n\nSiemens has released an update for SINEC NMS and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-943925.html"
      },
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-943925.json"
      },
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-943925.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-943925.txt"
      }
    ],
    "title": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1",
    "tracking": {
      "current_release_date": "2024-03-12T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-943925",
      "initial_release_date": "2024-02-13T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-02-13T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2024-03-12T00:00:00Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added missing acknowledgment for CVE-2024-23811"
        }
      ],
      "status": "interim",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "All versions \u003c V2.0 SP1",
                "product": {
                  "name": "SINEC NMS",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "SINEC NMS"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4203",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. The read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2022-4203"
    },
    {
      "cve": "CVE-2022-4304",
      "cwe": {
        "id": "CWE-326",
        "name": "Inadequate Encryption Strength"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2022-4304"
    },
    {
      "cve": "CVE-2022-4450",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data. If the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2022-4450"
    },
    {
      "cve": "CVE-2023-0215",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-0215"
    },
    {
      "cve": "CVE-2023-0216",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-0216"
    },
    {
      "cve": "CVE-2023-0217",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-0217"
    },
    {
      "cve": "CVE-2023-0286",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-0286"
    },
    {
      "cve": "CVE-2023-0401",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-0401"
    },
    {
      "cve": "CVE-2023-1255",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM\nplatform contains a bug that could cause it to read past the input buffer,\nleading to a crash.\n\nImpact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM\nplatform can crash in rare circumstances. The AES-XTS algorithm is usually\nused for disk encryption.\n\nThe AES-XTS cipher decryption implementation for 64 bit ARM platform will read\npast the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16\nbyte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext\nbuffer is unmapped, this will trigger a crash which results in a denial of\nservice.\n\nIf an attacker can control the size and location of the ciphertext buffer\nbeing decrypted by an application using AES-XTS on 64 bit ARM, the\napplication is affected. This is fairly unlikely making this issue\na Low severity one.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-1255"
    },
    {
      "cve": "CVE-2023-2454",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-2454"
    },
    {
      "cve": "CVE-2023-2455",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-2455"
    },
    {
      "cve": "CVE-2023-2650",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(square(n)) with \u0027n\u0027 being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer\u0027s certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-2650"
    },
    {
      "cve": "CVE-2023-2975",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be mislead by removing adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-2975"
    },
    {
      "cve": "CVE-2023-3446",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus (\u0027p\u0027 parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the \u0027-check\u0027 option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-3446"
    },
    {
      "cve": "CVE-2023-3817",
      "cwe": {
        "id": "CWE-834",
        "name": "Excessive Iteration"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the \"-check\" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-3817"
    },
    {
      "cve": "CVE-2023-25690",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.\r\n\r\nConfigurations are affected when mod_proxy is enabled along with some form of RewriteRule  or ProxyPassMatch in which a non-specific pattern matches  some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. \r\n\r\nRequest splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-25690"
    },
    {
      "cve": "CVE-2023-27522",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55.\n\nSpecial characters in the origin response header can truncate/split the response forwarded to the client.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-27522"
    },
    {
      "cve": "CVE-2023-27533",
      "cwe": {
        "id": "CWE-74",
        "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application\u0027s intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-27533"
    },
    {
      "cve": "CVE-2023-27534",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A path traversal vulnerability exists in curl \u003c8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user\u0027s home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-27534"
    },
    {
      "cve": "CVE-2023-27535",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An authentication bypass vulnerability exists in libcurl \u003c8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-27535"
    },
    {
      "cve": "CVE-2023-27536",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An authentication bypass vulnerability exists libcurl \u003c8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-27536"
    },
    {
      "cve": "CVE-2023-27537",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-27537"
    },
    {
      "cve": "CVE-2023-27538",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "libcurl would reuse a previously created connection even when an SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, two SSH settings were left out from the configuration match checks, making them match too easily.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-27538"
    },
    {
      "cve": "CVE-2023-28319",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A use after free vulnerability exists in curl \u003cv8.1.0 in the way libcurl offers a feature to verify an SSH server\u0027s public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-28319"
    },
    {
      "cve": "CVE-2023-28320",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-28320"
    },
    {
      "cve": "CVE-2023-28321",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An improper certificate validation vulnerability exists in curl \u003cv8.1.0 in the way it supports matching of wildcard patterns when listed as \"Subject Alternative Name\" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-28321"
    },
    {
      "cve": "CVE-2023-28322",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An information disclosure vulnerability exists in curl \u003cv8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-28322"
    },
    {
      "cve": "CVE-2023-28709",
      "cwe": {
        "id": "CWE-193",
        "name": "Off-by-one Error"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP       connector settings were used such that the maxParameterCount\u00a0could be reached using query string parameters and a request was       submitted that supplied exactly maxParameterCount parameters\u00a0in the query string, the limit for uploaded request parts could be\u00a0bypassed with the potential for a denial of service to occur.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-28709"
    },
    {
      "cve": "CVE-2023-30581",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30581"
    },
    {
      "cve": "CVE-2023-30582",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a result, malicious actors can monitor files that they do not have explicit read access to.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30582"
    },
    {
      "cve": "CVE-2023-30583",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js. This vulnerability arises from a missing check in the fs.openAsBlob() API.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30583"
    },
    {
      "cve": "CVE-2023-30584",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in the experimental permission model of Node.js leads to improper handling of path traversal bypass when verifying file permissions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30584"
    },
    {
      "cve": "CVE-2023-30585",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the \"msiexec.exe\" process, running under the NT AUTHORITY\\SYSTEM context, attempts to read the %USERPROFILE% environment variable from the current user\u0027s registry.\n\nThe issue arises when the path referenced by the %USERPROFILE% environment variable does not exist. In such cases, the \"msiexec.exe\" process attempts to create the specified path in an unsafe manner, potentially leading to the creation of arbitrary folders in arbitrary locations.\n\nThe severity of this vulnerability is heightened by the fact that the %USERPROFILE% environment variable in the Windows registry can be modified by standard (or \"non-privileged\") users. Consequently, unprivileged actors, including malicious entities or trojans, can manipulate the environment variable key to deceive the privileged \"msiexec.exe\" process. This manipulation can result in the creation of folders in unintended and potentially malicious locations.\n\nIt is important to note that this vulnerability is specific to Windows users who install Node.js using the .msi installer. Users who opt for other installation methods are not affected by this particular issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30585"
    },
    {
      "cve": "CVE-2023-30586",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for example, disable the permission model in the host process by manipulating the process\u0027s stack memory to locate the permission model Permission::enabled_ in the host process\u0027s heap memory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30586"
    },
    {
      "cve": "CVE-2023-30587",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in Node.js allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector). By exploiting the Worker class\u0027s ability to create an \"internal worker\" with the kIsInternal Symbol, attackers can modify the isInternal value when an inspector is attached within the Worker constructor before initializing a new WorkerImpl.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30587"
    },
    {
      "cve": "CVE-2023-30588",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30588"
    },
    {
      "cve": "CVE-2023-30589",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).\r\n\r\nThe CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30589"
    },
    {
      "cve": "CVE-2023-30590",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: \"Generates private and public Diffie-Hellman key values\".\n\nThe documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30590"
    },
    {
      "cve": "CVE-2023-31124",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android.  This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-31124"
    },
    {
      "cve": "CVE-2023-31130",
      "cwe": {
        "id": "CWE-124",
        "name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular \"0::00:00:00/2\" was found to cause an issue.  C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-31130"
    },
    {
      "cve": "CVE-2023-31147",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-31147"
    },
    {
      "cve": "CVE-2023-32002",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\n\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32002"
    },
    {
      "cve": "CVE-2023-32003",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32003"
    },
    {
      "cve": "CVE-2023-32004",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32004"
    },
    {
      "cve": "CVE-2023-32005",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument.\n\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the `fs.statfs` API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32005"
    },
    {
      "cve": "CVE-2023-32006",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\n\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32006"
    },
    {
      "cve": "CVE-2023-32067",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32067"
    },
    {
      "cve": "CVE-2023-32558",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. \n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.x.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32558"
    },
    {
      "cve": "CVE-2023-32559",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding(\u0027spawn_sync\u0027)` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32559"
    },
    {
      "cve": "CVE-2023-34035",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Spring Security versions 5.8\u00a0prior to 5.8.5, 6.0\u00a0prior to 6.0.5,\u00a0and 6.1\u00a0prior to 6.1.2\u00a0could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String)\u00a0and multiple servlets, one of them being Spring MVC\u2019s DispatcherServlet.\u00a0(DispatcherServlet\u00a0is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.)\n\nSpecifically, an application is vulnerable when all of the following are true:\n\n  *  Spring MVC is on the classpath\n  *  Spring Security is securing more than one servlet in a single application (one of them being Spring MVC\u2019s DispatcherServlet)\n  *  The application uses requestMatchers(String)\u00a0to refer to endpoints that are not Spring MVC endpoints\n\n\nAn application is not vulnerable if any of the following is true:\n\n  *  The application does not have Spring MVC on the classpath\n  *  The application secures no servlets other than Spring MVC\u2019s DispatcherServlet\n  *  The application uses requestMatchers(String)\u00a0only for Spring MVC endpoints",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-34035"
    },
    {
      "cve": "CVE-2023-35945",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy\u2019s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-35945"
    },
    {
      "cve": "CVE-2023-38039",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "When curl retrieves an HTTP response, it stores the incoming headers so that\nthey can be accessed later via the libcurl headers API.\n\nHowever, curl did not have a limit in how many or how large headers it would\naccept in a response, allowing a malicious server to stream an endless series\nof headers and eventually cause curl to run out of heap memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-38039"
    },
    {
      "cve": "CVE-2023-38199",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka \"Content-Type confusion\" between the WAF and the backend application. This occurs when the web application relies on only the last Content-Type header. Other platforms may reject the additional Content-Type header or merge conflicting headers, leading to detection as a malformed header.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-38199"
    },
    {
      "cve": "CVE-2023-38545",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.\r\n\r\nWhen curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255 bytes.\r\n\r\nIf the hostname is detected to be longer than 255 bytes, curl switches to local name resolving and instead passes on the resolved address only to the proxy. Due to a bug, the local variable that means \"let the host resolve the name\" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long hostname to the target buffer instead of copying just the resolved address there.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-38545"
    },
    {
      "cve": "CVE-2023-38546",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "notes": [
        {
          "category": "summary",
          "text": "This flaw allows an attacker to insert cookies at will into a running program\r\nusing libcurl, if the specific series of conditions are met.\r\n\r\nlibcurl performs transfers. In its API, an application creates \"easy handles\"\r\nthat are the individual handles for single transfers.\r\n\r\nlibcurl provides a function call that duplicates en easy handle called\r\n[curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).\r\n\r\nIf a transfer has cookies enabled when the handle is duplicated, the\r\ncookie-enable state is also cloned - but without cloning the actual\r\ncookies. If the source handle did not read any cookies from a specific file on\r\ndisk, the cloned version of the handle would instead store the file name as\r\n`none` (using the four ASCII letters, no quotes).\r\n\r\nSubsequent use of the cloned handle that does not explicitly set a source to\r\nload cookies from would then inadvertently load cookies from a file named\r\n`none` - if such a file exists and is readable in the current directory of the\r\nprogram using libcurl. And if using the correct file format of course.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-38546"
    },
    {
      "cve": "CVE-2023-39417",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, \u0027\u0027, or \"\"). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-39417"
    },
    {
      "cve": "CVE-2023-39418",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-39418"
    },
    {
      "cve": "CVE-2023-41080",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92.\n\nThe vulnerability is limited to the ROOT (default) web application.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-41080"
    },
    {
      "cve": "CVE-2023-46120",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects.  Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from  DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-46120"
    },
    {
      "cve": "CVE-2024-23810",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application is vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-23810"
    },
    {
      "cve": "CVE-2024-23811",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-23811"
    },
    {
      "cve": "CVE-2024-23812",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application incorrectly neutralizes special elements when creating a report which could lead to command injection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-23812"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SCALANCE XB-200/XC-200/XP-200/XF-200BA/XR-300WG Family before V4.5 is affected by multiple vulnerabilities.\n\nSiemens has released updates for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-699386.html"
      },
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-699386.json"
      },
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-699386.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-699386.txt"
      }
    ],
    "title": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5",
    "tracking": {
      "current_release_date": "2024-03-12T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-699386",
      "initial_release_date": "2023-11-14T00:00:00Z",
      "revision_history": [
        {
          "date": "2023-11-14T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2023-12-12T00:00:00Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Clarify: Remove product description for SCALANCE M-800/S615"
        },
        {
          "date": "2024-03-12T00:00:00Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Move CVE-2023-44318 and CVE-2023-44321 to SSA-353002 as it currently is still unfixed."
        }
      ],
      "status": "interim",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (SC, PN) (6GK5205-3BB00-2AB2)",
                  "product_id": "1",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BB00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (SC, PN) (6GK5205-3BB00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BB00-2TB2)",
                  "product_id": "2",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BB00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BB00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BD00-2TB2)",
                  "product_id": "3",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BD00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BD00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (ST, PN) (6GK5205-3BD00-2AB2)",
                  "product_id": "4",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BD00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (ST, PN) (6GK5205-3BD00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3LD (SC, E/IP) (6GK5205-3BF00-2TB2)",
                  "product_id": "5",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BF00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3LD (SC, E/IP) (6GK5205-3BF00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3LD (SC, PN) (6GK5205-3BF00-2AB2)",
                  "product_id": "6",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BF00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3LD (SC, PN) (6GK5205-3BF00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB208 (E/IP) (6GK5208-0BA00-2TB2)",
                  "product_id": "7",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB208 (E/IP) (6GK5208-0BA00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB208 (PN) (6GK5208-0BA00-2AB2)",
                  "product_id": "8",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB208 (PN) (6GK5208-0BA00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (SC, E/IP) (6GK5213-3BD00-2TB2)",
                  "product_id": "9",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BD00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (SC, E/IP) (6GK5213-3BD00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (SC, PN) (6GK5213-3BD00-2AB2)",
                  "product_id": "10",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BD00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (SC, PN) (6GK5213-3BD00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (ST, E/IP) (6GK5213-3BB00-2TB2)",
                  "product_id": "11",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BB00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (ST, E/IP) (6GK5213-3BB00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (ST, PN) (6GK5213-3BB00-2AB2)",
                  "product_id": "12",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BB00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (ST, PN) (6GK5213-3BB00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3LD (SC, E/IP) (6GK5213-3BF00-2TB2)",
                  "product_id": "13",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BF00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3LD (SC, E/IP) (6GK5213-3BF00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3LD (SC, PN) (6GK5213-3BF00-2AB2)",
                  "product_id": "14",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BF00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3LD (SC, PN) (6GK5213-3BF00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB216 (E/IP) (6GK5216-0BA00-2TB2)",
                  "product_id": "15",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB216 (E/IP) (6GK5216-0BA00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB216 (PN) (6GK5216-0BA00-2AB2)",
                  "product_id": "16",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB216 (PN) (6GK5216-0BA00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2 (SC) (6GK5206-2BD00-2AC2)",
                  "product_id": "17",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BD00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2 (SC) (6GK5206-2BD00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2 (ST/BFOC) (6GK5206-2BB00-2AC2)",
                  "product_id": "18",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BB00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2 (ST/BFOC) (6GK5206-2BB00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2G PoE (6GK5206-2RS00-2AC2)",
                  "product_id": "19",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2RS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2G PoE (6GK5206-2RS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2G PoE (54 V DC) (6GK5206-2RS00-5AC2)",
                  "product_id": "20",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2RS00-5AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2G PoE (54 V DC) (6GK5206-2RS00-5AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2G PoE EEC (54 V DC) (6GK5206-2RS00-5FC2)",
                  "product_id": "21",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2RS00-5FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2G PoE EEC (54 V DC) (6GK5206-2RS00-5FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP (6GK5206-2BS00-2AC2)",
                  "product_id": "22",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP (6GK5206-2BS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP EEC (6GK5206-2BS00-2FC2)",
                  "product_id": "23",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP EEC (6GK5206-2BS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP G (6GK5206-2GS00-2AC2)",
                  "product_id": "24",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2GS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP G (6GK5206-2GS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP G (EIP DEF.) (6GK5206-2GS00-2TC2)",
                  "product_id": "25",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2GS00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP G (EIP DEF.) (6GK5206-2GS00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP G EEC (6GK5206-2GS00-2FC2)",
                  "product_id": "26",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2GS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP G EEC (6GK5206-2GS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208 (6GK5208-0BA00-2AC2)",
                  "product_id": "27",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208 (6GK5208-0BA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208EEC (6GK5208-0BA00-2FC2)",
                  "product_id": "28",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208EEC (6GK5208-0BA00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G (6GK5208-0GA00-2AC2)",
                  "product_id": "29",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0GA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G (6GK5208-0GA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G (EIP def.) (6GK5208-0GA00-2TC2)",
                  "product_id": "30",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0GA00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G (EIP def.) (6GK5208-0GA00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G EEC (6GK5208-0GA00-2FC2)",
                  "product_id": "31",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0GA00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G EEC (6GK5208-0GA00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G PoE (6GK5208-0RA00-2AC2)",
                  "product_id": "32",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0RA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G PoE (6GK5208-0RA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G PoE (54 V DC) (6GK5208-0RA00-5AC2)",
                  "product_id": "33",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0RA00-5AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G PoE (54 V DC) (6GK5208-0RA00-5AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216 (6GK5216-0BA00-2AC2)",
                  "product_id": "34",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216 (6GK5216-0BA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-3G PoE (6GK5216-3RS00-2AC2)",
                  "product_id": "35",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-3RS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-3G PoE (6GK5216-3RS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-3G PoE (54 V DC) (6GK5216-3RS00-5AC2)",
                  "product_id": "36",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-3RS00-5AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-3G PoE (54 V DC) (6GK5216-3RS00-5AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C (6GK5216-4BS00-2AC2)",
                  "product_id": "37",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4BS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C (6GK5216-4BS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C G (6GK5216-4GS00-2AC2)",
                  "product_id": "38",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4GS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C G (6GK5216-4GS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C G (EIP Def.) (6GK5216-4GS00-2TC2)",
                  "product_id": "39",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4GS00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C G (EIP Def.) (6GK5216-4GS00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C G EEC (6GK5216-4GS00-2FC2)",
                  "product_id": "40",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4GS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C G EEC (6GK5216-4GS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216EEC (6GK5216-0BA00-2FC2)",
                  "product_id": "41",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216EEC (6GK5216-0BA00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224 (6GK5224-0BA00-2AC2)",
                  "product_id": "42",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-0BA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224 (6GK5224-0BA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224-4C G (6GK5224-4GS00-2AC2)",
                  "product_id": "43",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-4GS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224-4C G (6GK5224-4GS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224-4C G (EIP Def.) (6GK5224-4GS00-2TC2)",
                  "product_id": "44",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-4GS00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224-4C G (EIP Def.) (6GK5224-4GS00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224-4C G EEC (6GK5224-4GS00-2FC2)",
                  "product_id": "45",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-4GS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224-4C G EEC (6GK5224-4GS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204 (6GK5204-0BA00-2GF2)",
                  "product_id": "46",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-0BA00-2GF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204 (6GK5204-0BA00-2GF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204 DNA (6GK5204-0BA00-2YF2)",
                  "product_id": "47",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-0BA00-2YF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204 DNA (6GK5204-0BA00-2YF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204-2BA (6GK5204-2AA00-2GF2)",
                  "product_id": "48",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-2AA00-2GF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204-2BA (6GK5204-2AA00-2GF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204-2BA DNA (6GK5204-2AA00-2YF2)",
                  "product_id": "49",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-2AA00-2YF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204-2BA DNA (6GK5204-2AA00-2YF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208 (6GK5208-0HA00-2AS6)",
                  "product_id": "50",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0HA00-2AS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208 (6GK5208-0HA00-2AS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208 (Ethernet/IP) (6GK5208-0HA00-2TS6)",
                  "product_id": "51",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0HA00-2TS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208 (Ethernet/IP) (6GK5208-0HA00-2TS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208EEC (6GK5208-0HA00-2ES6)",
                  "product_id": "52",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0HA00-2ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208EEC (6GK5208-0HA00-2ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208PoE EEC (6GK5208-0UA00-5ES6)",
                  "product_id": "53",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0UA00-5ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208PoE EEC (6GK5208-0UA00-5ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216 (6GK5216-0HA00-2AS6)",
                  "product_id": "54",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0HA00-2AS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216 (6GK5216-0HA00-2AS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216 (Ethernet/IP) (6GK5216-0HA00-2TS6)",
                  "product_id": "55",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0HA00-2TS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216 (Ethernet/IP) (6GK5216-0HA00-2TS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216EEC (6GK5216-0HA00-2ES6)",
                  "product_id": "56",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0HA00-2ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216EEC (6GK5216-0HA00-2ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216POE EEC (6GK5216-0UA00-5ES6)",
                  "product_id": "57",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0UA00-5ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216POE EEC (6GK5216-0UA00-5ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR324WG (24 x FE, AC 230V) (6GK5324-0BA00-3AR3)",
                  "product_id": "58",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5324-0BA00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR324WG (24 x FE, AC 230V) (6GK5324-0BA00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR324WG (24 X FE, DC 24V) (6GK5324-0BA00-2AR3)",
                  "product_id": "59",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5324-0BA00-2AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR324WG (24 X FE, DC 24V) (6GK5324-0BA00-2AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR326-2C PoE WG (6GK5326-2QS00-3AR3)",
                  "product_id": "60",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5326-2QS00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR326-2C PoE WG (6GK5326-2QS00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR326-2C PoE WG (without UL) (6GK5326-2QS00-3RR3)",
                  "product_id": "61",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5326-2QS00-3RR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR326-2C PoE WG (without UL) (6GK5326-2QS00-3RR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3AR3)",
                  "product_id": "62",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3RR3)",
                  "product_id": "63",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-3RR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3RR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24XFE, 4XGE, 24V) (6GK5328-4FS00-2AR3)",
                  "product_id": "64",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-2AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24XFE, 4XGE, 24V) (6GK5328-4FS00-2AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24xFE, 4xGE,DC24V) (6GK5328-4FS00-2RR3)",
                  "product_id": "65",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-2RR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24xFE, 4xGE,DC24V) (6GK5328-4FS00-2RR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (28xGE, AC 230V) (6GK5328-4SS00-3AR3)",
                  "product_id": "66",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4SS00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (28xGE, AC 230V) (6GK5328-4SS00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (28xGE, DC 24V) (6GK5328-4SS00-2AR3)",
                  "product_id": "67",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4SS00-2AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (28xGE, DC 24V) (6GK5328-4SS00-2AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC206-2 (6AG1206-2BB00-7AC2)",
                  "product_id": "68",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1206-2BB00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC206-2 (6AG1206-2BB00-7AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC206-2SFP (6AG1206-2BS00-7AC2)",
                  "product_id": "69",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1206-2BS00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC206-2SFP (6AG1206-2BS00-7AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC208 (6AG1208-0BA00-7AC2)",
                  "product_id": "70",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1208-0BA00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC208 (6AG1208-0BA00-7AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC216-4C (6AG1216-4BS00-7AC2)",
                  "product_id": "71",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1216-4BS00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC216-4C (6AG1216-4BS00-7AC2)"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4203",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. The read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2022-4203"
    },
    {
      "cve": "CVE-2022-4304",
      "cwe": {
        "id": "CWE-326",
        "name": "Inadequate Encryption Strength"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2022-4304"
    },
    {
      "cve": "CVE-2022-4450",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data. If the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2022-4450"
    },
    {
      "cve": "CVE-2023-0216",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-0216"
    },
    {
      "cve": "CVE-2023-0217",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-0217"
    },
    {
      "cve": "CVE-2023-0401",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-0401"
    },
    {
      "cve": "CVE-2023-2650",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(square(n)) with \u0027n\u0027 being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer\u0027s certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-2650"
    },
    {
      "cve": "CVE-2023-44317",
      "cwe": {
        "id": "CWE-349",
        "name": "Acceptance of Extraneous Untrusted Data With Trusted Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected products do not properly validate the content of uploaded X509 certificates which could allow an attacker with administrative privileges to execute arbitrary code on the device.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44317"
    },
    {
      "cve": "CVE-2023-44319",
      "cwe": {
        "id": "CWE-328",
        "name": "Use of Weak Hash"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices use a weak checksum algorithm to protect the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with administrative privileges or an attacker that tricks a legitimate administrator to upload a modified configuration file to change the configuration of an affected device.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44319"
    },
    {
      "cve": "CVE-2023-44320",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request (\u0027Forced Browsing\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices do not properly validate the authentication when performing certain modifications in the web interface allowing an authenticated attacker to influence the user interface configured by an administrator.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44320"
    },
    {
      "cve": "CVE-2023-44322",
      "cwe": {
        "id": "CWE-252",
        "name": "Unchecked Return Value"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices can be configured to send emails when certain events occur on the device. When presented with an invalid response from the SMTP server, the device triggers an error that disrupts email sending. An attacker with access to the network can use this to do disable notification of users when certain events occur.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44322"
    },
    {
      "cve": "CVE-2023-44373",
      "cwe": {
        "id": "CWE-74",
        "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices do not properly sanitize an input field.  This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell. Follow-up of CVE-2022-36323.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44373"
    },
    {
      "cve": "CVE-2023-44374",
      "cwe": {
        "id": "CWE-567",
        "name": "Unsynchronized Access to Shared Data in a Multithreaded Context"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices allow to change the password, but insufficiently check which password is to be changed. With this  an authenticated attacker could, under certain conditions, be able to change the password of another, potential admin user allowing her to escalate her privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44374"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SINEC NMS before V2.0 SP1 is affected by multiple vulnerabilities.\n\nSiemens has released an update for SINEC NMS and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-943925.html"
      },
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-943925.json"
      },
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-943925.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-943925.txt"
      }
    ],
    "title": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1",
    "tracking": {
      "current_release_date": "2024-03-12T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-943925",
      "initial_release_date": "2024-02-13T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-02-13T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2024-03-12T00:00:00Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added missing acknowledgment for CVE-2024-23811"
        }
      ],
      "status": "interim",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "All versions \u003c V2.0 SP1",
                "product": {
                  "name": "SINEC NMS",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "SINEC NMS"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4203",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. The read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2022-4203"
    },
    {
      "cve": "CVE-2022-4304",
      "cwe": {
        "id": "CWE-326",
        "name": "Inadequate Encryption Strength"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2022-4304"
    },
    {
      "cve": "CVE-2022-4450",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data. If the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2022-4450"
    },
    {
      "cve": "CVE-2023-0215",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-0215"
    },
    {
      "cve": "CVE-2023-0216",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-0216"
    },
    {
      "cve": "CVE-2023-0217",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-0217"
    },
    {
      "cve": "CVE-2023-0286",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-0286"
    },
    {
      "cve": "CVE-2023-0401",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-0401"
    },
    {
      "cve": "CVE-2023-1255",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM\nplatform contains a bug that could cause it to read past the input buffer,\nleading to a crash.\n\nImpact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM\nplatform can crash in rare circumstances. The AES-XTS algorithm is usually\nused for disk encryption.\n\nThe AES-XTS cipher decryption implementation for 64 bit ARM platform will read\npast the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16\nbyte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext\nbuffer is unmapped, this will trigger a crash which results in a denial of\nservice.\n\nIf an attacker can control the size and location of the ciphertext buffer\nbeing decrypted by an application using AES-XTS on 64 bit ARM, the\napplication is affected. This is fairly unlikely making this issue\na Low severity one.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-1255"
    },
    {
      "cve": "CVE-2023-2454",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-2454"
    },
    {
      "cve": "CVE-2023-2455",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-2455"
    },
    {
      "cve": "CVE-2023-2650",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(square(n)) with \u0027n\u0027 being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer\u0027s certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-2650"
    },
    {
      "cve": "CVE-2023-2975",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be mislead by removing adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-2975"
    },
    {
      "cve": "CVE-2023-3446",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus (\u0027p\u0027 parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the \u0027-check\u0027 option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-3446"
    },
    {
      "cve": "CVE-2023-3817",
      "cwe": {
        "id": "CWE-834",
        "name": "Excessive Iteration"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the \"-check\" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-3817"
    },
    {
      "cve": "CVE-2023-25690",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.\r\n\r\nConfigurations are affected when mod_proxy is enabled along with some form of RewriteRule  or ProxyPassMatch in which a non-specific pattern matches  some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. \r\n\r\nRequest splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-25690"
    },
    {
      "cve": "CVE-2023-27522",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55.\n\nSpecial characters in the origin response header can truncate/split the response forwarded to the client.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-27522"
    },
    {
      "cve": "CVE-2023-27533",
      "cwe": {
        "id": "CWE-74",
        "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application\u0027s intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-27533"
    },
    {
      "cve": "CVE-2023-27534",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A path traversal vulnerability exists in curl \u003c8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user\u0027s home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-27534"
    },
    {
      "cve": "CVE-2023-27535",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An authentication bypass vulnerability exists in libcurl \u003c8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-27535"
    },
    {
      "cve": "CVE-2023-27536",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An authentication bypass vulnerability exists libcurl \u003c8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-27536"
    },
    {
      "cve": "CVE-2023-27537",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-27537"
    },
    {
      "cve": "CVE-2023-27538",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "libcurl would reuse a previously created connection even when an SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, two SSH settings were left out from the configuration match checks, making them match too easily.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-27538"
    },
    {
      "cve": "CVE-2023-28319",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A use after free vulnerability exists in curl \u003cv8.1.0 in the way libcurl offers a feature to verify an SSH server\u0027s public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-28319"
    },
    {
      "cve": "CVE-2023-28320",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-28320"
    },
    {
      "cve": "CVE-2023-28321",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An improper certificate validation vulnerability exists in curl \u003cv8.1.0 in the way it supports matching of wildcard patterns when listed as \"Subject Alternative Name\" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-28321"
    },
    {
      "cve": "CVE-2023-28322",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An information disclosure vulnerability exists in curl \u003cv8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-28322"
    },
    {
      "cve": "CVE-2023-28709",
      "cwe": {
        "id": "CWE-193",
        "name": "Off-by-one Error"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP       connector settings were used such that the maxParameterCount\u00a0could be reached using query string parameters and a request was       submitted that supplied exactly maxParameterCount parameters\u00a0in the query string, the limit for uploaded request parts could be\u00a0bypassed with the potential for a denial of service to occur.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-28709"
    },
    {
      "cve": "CVE-2023-30581",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30581"
    },
    {
      "cve": "CVE-2023-30582",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a result, malicious actors can monitor files that they do not have explicit read access to.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30582"
    },
    {
      "cve": "CVE-2023-30583",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js. This vulnerability arises from a missing check in the fs.openAsBlob() API.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30583"
    },
    {
      "cve": "CVE-2023-30584",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in the experimental permission model of Node.js leads to improper handling of path traversal bypass when verifying file permissions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30584"
    },
    {
      "cve": "CVE-2023-30585",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the \"msiexec.exe\" process, running under the NT AUTHORITY\\SYSTEM context, attempts to read the %USERPROFILE% environment variable from the current user\u0027s registry.\n\nThe issue arises when the path referenced by the %USERPROFILE% environment variable does not exist. In such cases, the \"msiexec.exe\" process attempts to create the specified path in an unsafe manner, potentially leading to the creation of arbitrary folders in arbitrary locations.\n\nThe severity of this vulnerability is heightened by the fact that the %USERPROFILE% environment variable in the Windows registry can be modified by standard (or \"non-privileged\") users. Consequently, unprivileged actors, including malicious entities or trojans, can manipulate the environment variable key to deceive the privileged \"msiexec.exe\" process. This manipulation can result in the creation of folders in unintended and potentially malicious locations.\n\nIt is important to note that this vulnerability is specific to Windows users who install Node.js using the .msi installer. Users who opt for other installation methods are not affected by this particular issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30585"
    },
    {
      "cve": "CVE-2023-30586",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for example, disable the permission model in the host process by manipulating the process\u0027s stack memory to locate the permission model Permission::enabled_ in the host process\u0027s heap memory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30586"
    },
    {
      "cve": "CVE-2023-30587",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in Node.js allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector). By exploiting the Worker class\u0027s ability to create an \"internal worker\" with the kIsInternal Symbol, attackers can modify the isInternal value when an inspector is attached within the Worker constructor before initializing a new WorkerImpl.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30587"
    },
    {
      "cve": "CVE-2023-30588",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30588"
    },
    {
      "cve": "CVE-2023-30589",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).\r\n\r\nThe CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30589"
    },
    {
      "cve": "CVE-2023-30590",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: \"Generates private and public Diffie-Hellman key values\".\n\nThe documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30590"
    },
    {
      "cve": "CVE-2023-31124",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android.  This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-31124"
    },
    {
      "cve": "CVE-2023-31130",
      "cwe": {
        "id": "CWE-124",
        "name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular \"0::00:00:00/2\" was found to cause an issue.  C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-31130"
    },
    {
      "cve": "CVE-2023-31147",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-31147"
    },
    {
      "cve": "CVE-2023-32002",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\n\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32002"
    },
    {
      "cve": "CVE-2023-32003",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32003"
    },
    {
      "cve": "CVE-2023-32004",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32004"
    },
    {
      "cve": "CVE-2023-32005",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument.\n\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the `fs.statfs` API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32005"
    },
    {
      "cve": "CVE-2023-32006",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\n\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32006"
    },
    {
      "cve": "CVE-2023-32067",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32067"
    },
    {
      "cve": "CVE-2023-32558",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. \n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.x.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32558"
    },
    {
      "cve": "CVE-2023-32559",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding(\u0027spawn_sync\u0027)` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-32559"
    },
    {
      "cve": "CVE-2023-34035",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Spring Security versions 5.8\u00a0prior to 5.8.5, 6.0\u00a0prior to 6.0.5,\u00a0and 6.1\u00a0prior to 6.1.2\u00a0could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String)\u00a0and multiple servlets, one of them being Spring MVC\u2019s DispatcherServlet.\u00a0(DispatcherServlet\u00a0is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.)\n\nSpecifically, an application is vulnerable when all of the following are true:\n\n  *  Spring MVC is on the classpath\n  *  Spring Security is securing more than one servlet in a single application (one of them being Spring MVC\u2019s DispatcherServlet)\n  *  The application uses requestMatchers(String)\u00a0to refer to endpoints that are not Spring MVC endpoints\n\n\nAn application is not vulnerable if any of the following is true:\n\n  *  The application does not have Spring MVC on the classpath\n  *  The application secures no servlets other than Spring MVC\u2019s DispatcherServlet\n  *  The application uses requestMatchers(String)\u00a0only for Spring MVC endpoints",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-34035"
    },
    {
      "cve": "CVE-2023-35945",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy\u2019s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-35945"
    },
    {
      "cve": "CVE-2023-38039",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "When curl retrieves an HTTP response, it stores the incoming headers so that\nthey can be accessed later via the libcurl headers API.\n\nHowever, curl did not have a limit in how many or how large headers it would\naccept in a response, allowing a malicious server to stream an endless series\nof headers and eventually cause curl to run out of heap memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-38039"
    },
    {
      "cve": "CVE-2023-38199",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka \"Content-Type confusion\" between the WAF and the backend application. This occurs when the web application relies on only the last Content-Type header. Other platforms may reject the additional Content-Type header or merge conflicting headers, leading to detection as a malformed header.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-38199"
    },
    {
      "cve": "CVE-2023-38545",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.\r\n\r\nWhen curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255 bytes.\r\n\r\nIf the hostname is detected to be longer than 255 bytes, curl switches to local name resolving and instead passes on the resolved address only to the proxy. Due to a bug, the local variable that means \"let the host resolve the name\" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long hostname to the target buffer instead of copying just the resolved address there.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-38545"
    },
    {
      "cve": "CVE-2023-38546",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "notes": [
        {
          "category": "summary",
          "text": "This flaw allows an attacker to insert cookies at will into a running program\r\nusing libcurl, if the specific series of conditions are met.\r\n\r\nlibcurl performs transfers. In its API, an application creates \"easy handles\"\r\nthat are the individual handles for single transfers.\r\n\r\nlibcurl provides a function call that duplicates en easy handle called\r\n[curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).\r\n\r\nIf a transfer has cookies enabled when the handle is duplicated, the\r\ncookie-enable state is also cloned - but without cloning the actual\r\ncookies. If the source handle did not read any cookies from a specific file on\r\ndisk, the cloned version of the handle would instead store the file name as\r\n`none` (using the four ASCII letters, no quotes).\r\n\r\nSubsequent use of the cloned handle that does not explicitly set a source to\r\nload cookies from would then inadvertently load cookies from a file named\r\n`none` - if such a file exists and is readable in the current directory of the\r\nprogram using libcurl. And if using the correct file format of course.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-38546"
    },
    {
      "cve": "CVE-2023-39417",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, \u0027\u0027, or \"\"). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-39417"
    },
    {
      "cve": "CVE-2023-39418",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-39418"
    },
    {
      "cve": "CVE-2023-41080",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92.\n\nThe vulnerability is limited to the ROOT (default) web application.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-41080"
    },
    {
      "cve": "CVE-2023-46120",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects.  Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from  DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-46120"
    },
    {
      "cve": "CVE-2024-23810",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application is vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-23810"
    },
    {
      "cve": "CVE-2024-23811",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-23811"
    },
    {
      "cve": "CVE-2024-23812",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application incorrectly neutralizes special elements when creating a report which could lead to command injection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-23812"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SCALANCE XB-200/XC-200/XP-200/XF-200BA/XR-300WG Family before V4.5 is affected by multiple vulnerabilities.\n\nSiemens has released updates for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-699386.html"
      },
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-699386.json"
      },
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-699386.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-699386.txt"
      }
    ],
    "title": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5",
    "tracking": {
      "current_release_date": "2024-03-12T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-699386",
      "initial_release_date": "2023-11-14T00:00:00Z",
      "revision_history": [
        {
          "date": "2023-11-14T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2023-12-12T00:00:00Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Clarify: Remove product description for SCALANCE M-800/S615"
        },
        {
          "date": "2024-03-12T00:00:00Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Move CVE-2023-44318 and CVE-2023-44321 to SSA-353002 as it currently is still unfixed."
        }
      ],
      "status": "interim",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (SC, PN) (6GK5205-3BB00-2AB2)",
                  "product_id": "1",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BB00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (SC, PN) (6GK5205-3BB00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BB00-2TB2)",
                  "product_id": "2",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BB00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BB00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BD00-2TB2)",
                  "product_id": "3",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BD00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BD00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (ST, PN) (6GK5205-3BD00-2AB2)",
                  "product_id": "4",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BD00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (ST, PN) (6GK5205-3BD00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3LD (SC, E/IP) (6GK5205-3BF00-2TB2)",
                  "product_id": "5",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BF00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3LD (SC, E/IP) (6GK5205-3BF00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3LD (SC, PN) (6GK5205-3BF00-2AB2)",
                  "product_id": "6",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BF00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3LD (SC, PN) (6GK5205-3BF00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB208 (E/IP) (6GK5208-0BA00-2TB2)",
                  "product_id": "7",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB208 (E/IP) (6GK5208-0BA00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB208 (PN) (6GK5208-0BA00-2AB2)",
                  "product_id": "8",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB208 (PN) (6GK5208-0BA00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (SC, E/IP) (6GK5213-3BD00-2TB2)",
                  "product_id": "9",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BD00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (SC, E/IP) (6GK5213-3BD00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (SC, PN) (6GK5213-3BD00-2AB2)",
                  "product_id": "10",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BD00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (SC, PN) (6GK5213-3BD00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (ST, E/IP) (6GK5213-3BB00-2TB2)",
                  "product_id": "11",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BB00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (ST, E/IP) (6GK5213-3BB00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (ST, PN) (6GK5213-3BB00-2AB2)",
                  "product_id": "12",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BB00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (ST, PN) (6GK5213-3BB00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3LD (SC, E/IP) (6GK5213-3BF00-2TB2)",
                  "product_id": "13",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BF00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3LD (SC, E/IP) (6GK5213-3BF00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3LD (SC, PN) (6GK5213-3BF00-2AB2)",
                  "product_id": "14",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BF00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3LD (SC, PN) (6GK5213-3BF00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB216 (E/IP) (6GK5216-0BA00-2TB2)",
                  "product_id": "15",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB216 (E/IP) (6GK5216-0BA00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB216 (PN) (6GK5216-0BA00-2AB2)",
                  "product_id": "16",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB216 (PN) (6GK5216-0BA00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2 (SC) (6GK5206-2BD00-2AC2)",
                  "product_id": "17",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BD00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2 (SC) (6GK5206-2BD00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2 (ST/BFOC) (6GK5206-2BB00-2AC2)",
                  "product_id": "18",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BB00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2 (ST/BFOC) (6GK5206-2BB00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2G PoE (6GK5206-2RS00-2AC2)",
                  "product_id": "19",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2RS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2G PoE (6GK5206-2RS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2G PoE (54 V DC) (6GK5206-2RS00-5AC2)",
                  "product_id": "20",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2RS00-5AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2G PoE (54 V DC) (6GK5206-2RS00-5AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2G PoE EEC (54 V DC) (6GK5206-2RS00-5FC2)",
                  "product_id": "21",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2RS00-5FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2G PoE EEC (54 V DC) (6GK5206-2RS00-5FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP (6GK5206-2BS00-2AC2)",
                  "product_id": "22",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP (6GK5206-2BS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP EEC (6GK5206-2BS00-2FC2)",
                  "product_id": "23",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP EEC (6GK5206-2BS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP G (6GK5206-2GS00-2AC2)",
                  "product_id": "24",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2GS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP G (6GK5206-2GS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP G (EIP DEF.) (6GK5206-2GS00-2TC2)",
                  "product_id": "25",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2GS00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP G (EIP DEF.) (6GK5206-2GS00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP G EEC (6GK5206-2GS00-2FC2)",
                  "product_id": "26",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2GS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP G EEC (6GK5206-2GS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208 (6GK5208-0BA00-2AC2)",
                  "product_id": "27",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208 (6GK5208-0BA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208EEC (6GK5208-0BA00-2FC2)",
                  "product_id": "28",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208EEC (6GK5208-0BA00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G (6GK5208-0GA00-2AC2)",
                  "product_id": "29",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0GA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G (6GK5208-0GA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G (EIP def.) (6GK5208-0GA00-2TC2)",
                  "product_id": "30",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0GA00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G (EIP def.) (6GK5208-0GA00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G EEC (6GK5208-0GA00-2FC2)",
                  "product_id": "31",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0GA00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G EEC (6GK5208-0GA00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G PoE (6GK5208-0RA00-2AC2)",
                  "product_id": "32",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0RA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G PoE (6GK5208-0RA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G PoE (54 V DC) (6GK5208-0RA00-5AC2)",
                  "product_id": "33",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0RA00-5AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G PoE (54 V DC) (6GK5208-0RA00-5AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216 (6GK5216-0BA00-2AC2)",
                  "product_id": "34",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216 (6GK5216-0BA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-3G PoE (6GK5216-3RS00-2AC2)",
                  "product_id": "35",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-3RS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-3G PoE (6GK5216-3RS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-3G PoE (54 V DC) (6GK5216-3RS00-5AC2)",
                  "product_id": "36",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-3RS00-5AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-3G PoE (54 V DC) (6GK5216-3RS00-5AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C (6GK5216-4BS00-2AC2)",
                  "product_id": "37",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4BS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C (6GK5216-4BS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C G (6GK5216-4GS00-2AC2)",
                  "product_id": "38",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4GS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C G (6GK5216-4GS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C G (EIP Def.) (6GK5216-4GS00-2TC2)",
                  "product_id": "39",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4GS00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C G (EIP Def.) (6GK5216-4GS00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C G EEC (6GK5216-4GS00-2FC2)",
                  "product_id": "40",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4GS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C G EEC (6GK5216-4GS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216EEC (6GK5216-0BA00-2FC2)",
                  "product_id": "41",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216EEC (6GK5216-0BA00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224 (6GK5224-0BA00-2AC2)",
                  "product_id": "42",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-0BA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224 (6GK5224-0BA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224-4C G (6GK5224-4GS00-2AC2)",
                  "product_id": "43",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-4GS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224-4C G (6GK5224-4GS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224-4C G (EIP Def.) (6GK5224-4GS00-2TC2)",
                  "product_id": "44",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-4GS00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224-4C G (EIP Def.) (6GK5224-4GS00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224-4C G EEC (6GK5224-4GS00-2FC2)",
                  "product_id": "45",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-4GS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224-4C G EEC (6GK5224-4GS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204 (6GK5204-0BA00-2GF2)",
                  "product_id": "46",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-0BA00-2GF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204 (6GK5204-0BA00-2GF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204 DNA (6GK5204-0BA00-2YF2)",
                  "product_id": "47",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-0BA00-2YF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204 DNA (6GK5204-0BA00-2YF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204-2BA (6GK5204-2AA00-2GF2)",
                  "product_id": "48",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-2AA00-2GF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204-2BA (6GK5204-2AA00-2GF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204-2BA DNA (6GK5204-2AA00-2YF2)",
                  "product_id": "49",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-2AA00-2YF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204-2BA DNA (6GK5204-2AA00-2YF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208 (6GK5208-0HA00-2AS6)",
                  "product_id": "50",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0HA00-2AS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208 (6GK5208-0HA00-2AS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208 (Ethernet/IP) (6GK5208-0HA00-2TS6)",
                  "product_id": "51",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0HA00-2TS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208 (Ethernet/IP) (6GK5208-0HA00-2TS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208EEC (6GK5208-0HA00-2ES6)",
                  "product_id": "52",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0HA00-2ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208EEC (6GK5208-0HA00-2ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208PoE EEC (6GK5208-0UA00-5ES6)",
                  "product_id": "53",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0UA00-5ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208PoE EEC (6GK5208-0UA00-5ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216 (6GK5216-0HA00-2AS6)",
                  "product_id": "54",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0HA00-2AS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216 (6GK5216-0HA00-2AS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216 (Ethernet/IP) (6GK5216-0HA00-2TS6)",
                  "product_id": "55",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0HA00-2TS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216 (Ethernet/IP) (6GK5216-0HA00-2TS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216EEC (6GK5216-0HA00-2ES6)",
                  "product_id": "56",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0HA00-2ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216EEC (6GK5216-0HA00-2ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216POE EEC (6GK5216-0UA00-5ES6)",
                  "product_id": "57",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0UA00-5ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216POE EEC (6GK5216-0UA00-5ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR324WG (24 x FE, AC 230V) (6GK5324-0BA00-3AR3)",
                  "product_id": "58",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5324-0BA00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR324WG (24 x FE, AC 230V) (6GK5324-0BA00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR324WG (24 X FE, DC 24V) (6GK5324-0BA00-2AR3)",
                  "product_id": "59",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5324-0BA00-2AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR324WG (24 X FE, DC 24V) (6GK5324-0BA00-2AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR326-2C PoE WG (6GK5326-2QS00-3AR3)",
                  "product_id": "60",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5326-2QS00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR326-2C PoE WG (6GK5326-2QS00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR326-2C PoE WG (without UL) (6GK5326-2QS00-3RR3)",
                  "product_id": "61",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5326-2QS00-3RR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR326-2C PoE WG (without UL) (6GK5326-2QS00-3RR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3AR3)",
                  "product_id": "62",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3RR3)",
                  "product_id": "63",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-3RR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3RR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24XFE, 4XGE, 24V) (6GK5328-4FS00-2AR3)",
                  "product_id": "64",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-2AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24XFE, 4XGE, 24V) (6GK5328-4FS00-2AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24xFE, 4xGE,DC24V) (6GK5328-4FS00-2RR3)",
                  "product_id": "65",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-2RR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24xFE, 4xGE,DC24V) (6GK5328-4FS00-2RR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (28xGE, AC 230V) (6GK5328-4SS00-3AR3)",
                  "product_id": "66",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4SS00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (28xGE, AC 230V) (6GK5328-4SS00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (28xGE, DC 24V) (6GK5328-4SS00-2AR3)",
                  "product_id": "67",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4SS00-2AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (28xGE, DC 24V) (6GK5328-4SS00-2AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC206-2 (6AG1206-2BB00-7AC2)",
                  "product_id": "68",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1206-2BB00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC206-2 (6AG1206-2BB00-7AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC206-2SFP (6AG1206-2BS00-7AC2)",
                  "product_id": "69",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1206-2BS00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC206-2SFP (6AG1206-2BS00-7AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC208 (6AG1208-0BA00-7AC2)",
                  "product_id": "70",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1208-0BA00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC208 (6AG1208-0BA00-7AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC216-4C (6AG1216-4BS00-7AC2)",
                  "product_id": "71",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1216-4BS00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC216-4C (6AG1216-4BS00-7AC2)"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4203",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. The read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2022-4203"
    },
    {
      "cve": "CVE-2022-4304",
      "cwe": {
        "id": "CWE-326",
        "name": "Inadequate Encryption Strength"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2022-4304"
    },
    {
      "cve": "CVE-2022-4450",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data. If the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2022-4450"
    },
    {
      "cve": "CVE-2023-0216",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-0216"
    },
    {
      "cve": "CVE-2023-0217",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-0217"
    },
    {
      "cve": "CVE-2023-0401",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-0401"
    },
    {
      "cve": "CVE-2023-2650",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(square(n)) with \u0027n\u0027 being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer\u0027s certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-2650"
    },
    {
      "cve": "CVE-2023-44317",
      "cwe": {
        "id": "CWE-349",
        "name": "Acceptance of Extraneous Untrusted Data With Trusted Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected products do not properly validate the content of uploaded X509 certificates which could allow an attacker with administrative privileges to execute arbitrary code on the device.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44317"
    },
    {
      "cve": "CVE-2023-44319",
      "cwe": {
        "id": "CWE-328",
        "name": "Use of Weak Hash"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices use a weak checksum algorithm to protect the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with administrative privileges or an attacker that tricks a legitimate administrator to upload a modified configuration file to change the configuration of an affected device.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44319"
    },
    {
      "cve": "CVE-2023-44320",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request (\u0027Forced Browsing\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices do not properly validate the authentication when performing certain modifications in the web interface allowing an authenticated attacker to influence the user interface configured by an administrator.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44320"
    },
    {
      "cve": "CVE-2023-44322",
      "cwe": {
        "id": "CWE-252",
        "name": "Unchecked Return Value"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices can be configured to send emails when certain events occur on the device. When presented with an invalid response from the SMTP server, the device triggers an error that disrupts email sending. An attacker with access to the network can use this to do disable notification of users when certain events occur.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44322"
    },
    {
      "cve": "CVE-2023-44373",
      "cwe": {
        "id": "CWE-74",
        "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices do not properly sanitize an input field.  This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell. Follow-up of CVE-2022-36323.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44373"
    },
    {
      "cve": "CVE-2023-44374",
      "cwe": {
        "id": "CWE-567",
        "name": "Unsynchronized Access to Shared Data in a Multithreaded Context"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices allow to change the password, but insufficiently check which password is to be changed. With this  an authenticated attacker could, under certain conditions, be able to change the password of another, potential admin user allowing her to escalate her privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44374"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "ICONICS",
        "summary": "reporting these vulnerabilities to CISA"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could result in information disclosure, denial-of-service, or remote code execution.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Critical Manufacturing",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "ICONICS is headquartered in the United States. Mitsubishi Electric is headquartered in Japan.",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolating them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-229-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-229-01.json"
      },
      {
        "category": "self",
        "summary": "ICSA Advisory ICSA-23-229-01 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-229-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "ICONICS and Mitsubishi Electric Products",
    "tracking": {
      "current_release_date": "2023-08-17T06:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-23-229-01",
      "initial_release_date": "2023-08-17T06:00:00.000000Z",
      "revision_history": [
        {
          "date": "2023-08-17T06:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "Initial Publication"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.97.2",
                "product": {
                  "name": "ICONICS Suite including GENESIS64, Hyper Historian, AnalytiX, and MobileHMI: 10.97.2",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "ICONICS Suite including GENESIS64, Hyper Historian, AnalytiX, and MobileHMI"
          }
        ],
        "category": "vendor",
        "name": "ICONICS, Mitsubishi Electric"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-3602",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A denial of service and potential crash vulnerability due to a buffer overrun condition exists in the OpenSSL library used in the ICONICS Suite. This vulnerability is in the X.509 certificate name constraint checking.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3602"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Version 10.97.2 Critical Fixes Rollup 2 and later is not vulnerable to these exploits. ICONICS recommends that users of its products take the following mitigation steps:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure the 10.97.2 Critical Fixes Rollup release is applied to version 10.97.2 systems.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For systems that do not contain the patch/fix:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not use the BACnet/SC feature on a production system.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric recommend updating the ICONICS Suite with the latest security patches as they become available. ICONICS Suite security patches may be found here (login required).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://partners.iconics.com/Home.aspx"
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing security updates as critical fixes/rollups release. For more information, refer to the ICONICS whitepaper on security vulnerabilities, the most recent version of which can be found here.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information about the security updates may also be found in Mitsubishi Electric\u0027s security advisories:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Advisory 2022-014",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdf"
        },
        {
          "category": "mitigation",
          "details": "Advisory 2023-009",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-009_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-3786",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A denial-of-service vulnerability due to a buffer overrun condition exists in the OpenSSL library used in the ICONICS Suite. This vulnerability is in the X.509 certificate verification.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3786"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Version 10.97.2 Critical Fixes Rollup 2 and later is not vulnerable to these exploits. ICONICS recommends that users of its products take the following mitigation steps:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure the 10.97.2 Critical Fixes Rollup release is applied to version 10.97.2 systems.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For systems that do not contain the patch/fix:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not use the BACnet/SC feature on a production system.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric recommend updating the ICONICS Suite with the latest security patches as they become available. ICONICS Suite security patches may be found here (login required).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://partners.iconics.com/Home.aspx"
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing security updates as critical fixes/rollups release. For more information, refer to the ICONICS whitepaper on security vulnerabilities, the most recent version of which can be found here.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information about the security updates may also be found in Mitsubishi Electric\u0027s security advisories:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Advisory 2022-014",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdf"
        },
        {
          "category": "mitigation",
          "details": "Advisory 2023-009",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-009_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-4203",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A denial-of-service vulnerability due to an out of bounds read condition exists in the OpenSSL library used in the ICONICS Suite. This vulnerability is in the X.509 certificate verification.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4203"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Version 10.97.2 Critical Fixes Rollup 2 and later is not vulnerable to these exploits. ICONICS recommends that users of its products take the following mitigation steps:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure the 10.97.2 Critical Fixes Rollup release is applied to version 10.97.2 systems.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For systems that do not contain the patch/fix:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not use the BACnet/SC feature on a production system.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric recommend updating the ICONICS Suite with the latest security patches as they become available. ICONICS Suite security patches may be found here (login required).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://partners.iconics.com/Home.aspx"
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing security updates as critical fixes/rollups release. For more information, refer to the ICONICS whitepaper on security vulnerabilities, the most recent version of which can be found here.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information about the security updates may also be found in Mitsubishi Electric\u0027s security advisories:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Advisory 2022-014",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdf"
        },
        {
          "category": "mitigation",
          "details": "Advisory 2023-009",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-009_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-4304",
      "cwe": {
        "id": "CWE-208",
        "name": "Observable Timing Discrepancy"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An information disclosure vulnerability due to an observable timing discrepancy exists in the OpenSSL library used in the ICONICS Suite. This vulnerability is in the RSA decryption implementation.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4304"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Version 10.97.2 Critical Fixes Rollup 2 and later is not vulnerable to these exploits. ICONICS recommends that users of its products take the following mitigation steps:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure the 10.97.2 Critical Fixes Rollup release is applied to version 10.97.2 systems.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For systems that do not contain the patch/fix:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not use the BACnet/SC feature on a production system.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric recommend updating the ICONICS Suite with the latest security patches as they become available. ICONICS Suite security patches may be found here (login required).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://partners.iconics.com/Home.aspx"
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing security updates as critical fixes/rollups release. For more information, refer to the ICONICS whitepaper on security vulnerabilities, the most recent version of which can be found here.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information about the security updates may also be found in Mitsubishi Electric\u0027s security advisories:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Advisory 2022-014",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdf"
        },
        {
          "category": "mitigation",
          "details": "Advisory 2023-009",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-009_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-4450",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A denial of service and potential crash vulnerability due to a double free condition exists in the OpenSSL library used in the ICONICS Suite. This vulnerability is in the reading of a PEM file.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4450"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Version 10.97.2 Critical Fixes Rollup 2 and later is not vulnerable to these exploits. ICONICS recommends that users of its products take the following mitigation steps:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure the 10.97.2 Critical Fixes Rollup release is applied to version 10.97.2 systems.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For systems that do not contain the patch/fix:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not use the BACnet/SC feature on a production system.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric recommend updating the ICONICS Suite with the latest security patches as they become available. ICONICS Suite security patches may be found here (login required).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://partners.iconics.com/Home.aspx"
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing security updates as critical fixes/rollups release. For more information, refer to the ICONICS whitepaper on security vulnerabilities, the most recent version of which can be found here.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information about the security updates may also be found in Mitsubishi Electric\u0027s security advisories:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Advisory 2022-014",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdf"
        },
        {
          "category": "mitigation",
          "details": "Advisory 2023-009",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-009_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2023-0401",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A denial of service and potential crash vulnerability due to a NULL Pointer dereference exists in the OpenSSL library used in the ICONICS Suite. This vulnerability can occur when signatures are being verified.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-0401"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Version 10.97.2 Critical Fixes Rollup 2 and later is not vulnerable to these exploits. ICONICS recommends that users of its products take the following mitigation steps:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure the 10.97.2 Critical Fixes Rollup release is applied to version 10.97.2 systems.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For systems that do not contain the patch/fix:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not use the BACnet/SC feature on a production system.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric recommend updating the ICONICS Suite with the latest security patches as they become available. ICONICS Suite security patches may be found here (login required).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://partners.iconics.com/Home.aspx"
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing security updates as critical fixes/rollups release. For more information, refer to the ICONICS whitepaper on security vulnerabilities, the most recent version of which can be found here.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information about the security updates may also be found in Mitsubishi Electric\u0027s security advisories:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Advisory 2022-014",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdf"
        },
        {
          "category": "mitigation",
          "details": "Advisory 2023-009",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-009_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting these vulnerabilities to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SINEC NMS before V2.0 SP1 is affected by multiple vulnerabilities.\n\nSiemens has released an update for SINEC NMS and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-943925.json"
      },
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-943925.html"
      },
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-943925.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-943925.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-046-15 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-046-15.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-046-15 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-046-15"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens SINEC NMS",
    "tracking": {
      "current_release_date": "2024-02-13T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1"
        }
      },
      "id": "ICSA-24-046-15",
      "initial_release_date": "2024-02-13T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2024-02-13T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV2.0_SP1",
                "product": {
                  "name": "SINEC NMS",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "SINEC NMS"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4203",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. The read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2022-4203"
    },
    {
      "cve": "CVE-2022-4304",
      "cwe": {
        "id": "CWE-326",
        "name": "Inadequate Encryption Strength"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2022-4304"
    },
    {
      "cve": "CVE-2022-4450",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data. If the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2022-4450"
    },
    {
      "cve": "CVE-2023-0215",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-0215"
    },
    {
      "cve": "CVE-2023-0216",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-0216"
    },
    {
      "cve": "CVE-2023-0217",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-0217"
    },
    {
      "cve": "CVE-2023-0286",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-0286"
    },
    {
      "cve": "CVE-2023-0401",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-0401"
    },
    {
      "cve": "CVE-2023-1255",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM\nplatform contains a bug that could cause it to read past the input buffer,\nleading to a crash.\n\nImpact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM\nplatform can crash in rare circumstances. The AES-XTS algorithm is usually\nused for disk encryption.\n\nThe AES-XTS cipher decryption implementation for 64 bit ARM platform will read\npast the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16\nbyte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext\nbuffer is unmapped, this will trigger a crash which results in a denial of\nservice.\n\nIf an attacker can control the size and location of the ciphertext buffer\nbeing decrypted by an application using AES-XTS on 64 bit ARM, the\napplication is affected. This is fairly unlikely making this issue\na Low severity one.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-1255"
    },
    {
      "cve": "CVE-2023-2454",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-2454"
    },
    {
      "cve": "CVE-2023-2455",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-2455"
    },
    {
      "cve": "CVE-2023-2650",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(square(n)) with \u0027n\u0027 being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer\u0027s certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-2650"
    },
    {
      "cve": "CVE-2023-2975",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be mislead by removing adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-2975"
    },
    {
      "cve": "CVE-2023-3446",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus (\u0027p\u0027 parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the \u0027-check\u0027 option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-3446"
    },
    {
      "cve": "CVE-2023-3817",
      "cwe": {
        "id": "CWE-834",
        "name": "Excessive Iteration"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the \"-check\" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-3817"
    },
    {
      "cve": "CVE-2023-25690",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.\r\n\r\nConfigurations are affected when mod_proxy is enabled along with some form of RewriteRule  or ProxyPassMatch in which a non-specific pattern matches  some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. \r\n\r\nRequest splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-25690"
    },
    {
      "cve": "CVE-2023-27522",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55.\n\nSpecial characters in the origin response header can truncate/split the response forwarded to the client.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-27522"
    },
    {
      "cve": "CVE-2023-27533",
      "cwe": {
        "id": "CWE-74",
        "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application\u0027s intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-27533"
    },
    {
      "cve": "CVE-2023-27534",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A path traversal vulnerability exists in curl \u003c8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user\u0027s home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-27534"
    },
    {
      "cve": "CVE-2023-27535",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An authentication bypass vulnerability exists in libcurl \u003c8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-27535"
    },
    {
      "cve": "CVE-2023-27536",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An authentication bypass vulnerability exists libcurl \u003c8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-27536"
    },
    {
      "cve": "CVE-2023-27537",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-27537"
    },
    {
      "cve": "CVE-2023-27538",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "libcurl would reuse a previously created connection even when an SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, two SSH settings were left out from the configuration match checks, making them match too easily.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-27538"
    },
    {
      "cve": "CVE-2023-28319",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A use after free vulnerability exists in curl \u003cv8.1.0 in the way libcurl offers a feature to verify an SSH server\u0027s public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-28319"
    },
    {
      "cve": "CVE-2023-28320",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-28320"
    },
    {
      "cve": "CVE-2023-28321",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An improper certificate validation vulnerability exists in curl \u003cv8.1.0 in the way it supports matching of wildcard patterns when listed as \"Subject Alternative Name\" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-28321"
    },
    {
      "cve": "CVE-2023-28322",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An information disclosure vulnerability exists in curl \u003cv8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-28322"
    },
    {
      "cve": "CVE-2023-28709",
      "cwe": {
        "id": "CWE-193",
        "name": "Off-by-one Error"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP       connector settings were used such that the maxParameterCount\u00a0could be reached using query string parameters and a request was       submitted that supplied exactly maxParameterCount parameters\u00a0in the query string, the limit for uploaded request parts could be\u00a0bypassed with the potential for a denial of service to occur.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-28709"
    },
    {
      "cve": "CVE-2023-30581",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30581"
    },
    {
      "cve": "CVE-2023-30582",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a result, malicious actors can monitor files that they do not have explicit read access to.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30582"
    },
    {
      "cve": "CVE-2023-30583",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js. This vulnerability arises from a missing check in the fs.openAsBlob() API.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30583"
    },
    {
      "cve": "CVE-2023-30584",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in the experimental permission model of Node.js leads to improper handling of path traversal bypass when verifying file permissions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30584"
    },
    {
      "cve": "CVE-2023-30585",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the \"msiexec.exe\" process, running under the NT AUTHORITY\\SYSTEM context, attempts to read the %USERPROFILE% environment variable from the current user\u0027s registry.\n\nThe issue arises when the path referenced by the %USERPROFILE% environment variable does not exist. In such cases, the \"msiexec.exe\" process attempts to create the specified path in an unsafe manner, potentially leading to the creation of arbitrary folders in arbitrary locations.\n\nThe severity of this vulnerability is heightened by the fact that the %USERPROFILE% environment variable in the Windows registry can be modified by standard (or \"non-privileged\") users. Consequently, unprivileged actors, including malicious entities or trojans, can manipulate the environment variable key to deceive the privileged \"msiexec.exe\" process. This manipulation can result in the creation of folders in unintended and potentially malicious locations.\n\nIt is important to note that this vulnerability is specific to Windows users who install Node.js using the .msi installer. Users who opt for other installation methods are not affected by this particular issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30585"
    },
    {
      "cve": "CVE-2023-30586",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for example, disable the permission model in the host process by manipulating the process\u0027s stack memory to locate the permission model Permission::enabled_ in the host process\u0027s heap memory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30586"
    },
    {
      "cve": "CVE-2023-30587",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in Node.js allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector). By exploiting the Worker class\u0027s ability to create an \"internal worker\" with the kIsInternal Symbol, attackers can modify the isInternal value when an inspector is attached within the Worker constructor before initializing a new WorkerImpl.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30587"
    },
    {
      "cve": "CVE-2023-30588",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30588"
    },
    {
      "cve": "CVE-2023-30589",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).\r\n\r\nThe CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30589"
    },
    {
      "cve": "CVE-2023-30590",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: \"Generates private and public Diffie-Hellman key values\".\n\nThe documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30590"
    },
    {
      "cve": "CVE-2023-31124",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android.  This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-31124"
    },
    {
      "cve": "CVE-2023-31130",
      "cwe": {
        "id": "CWE-124",
        "name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular \"0::00:00:00/2\" was found to cause an issue.  C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-31130"
    },
    {
      "cve": "CVE-2023-31147",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-31147"
    },
    {
      "cve": "CVE-2023-32002",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\n\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32002"
    },
    {
      "cve": "CVE-2023-32003",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32003"
    },
    {
      "cve": "CVE-2023-32004",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32004"
    },
    {
      "cve": "CVE-2023-32005",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument.\n\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the `fs.statfs` API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32005"
    },
    {
      "cve": "CVE-2023-32006",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\n\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32006"
    },
    {
      "cve": "CVE-2023-32067",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32067"
    },
    {
      "cve": "CVE-2023-32558",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. \n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.x.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32558"
    },
    {
      "cve": "CVE-2023-32559",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding(\u0027spawn_sync\u0027)` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32559"
    },
    {
      "cve": "CVE-2023-34035",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Spring Security versions 5.8\u00a0prior to 5.8.5, 6.0\u00a0prior to 6.0.5,\u00a0and 6.1\u00a0prior to 6.1.2\u00a0could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String)\u00a0and multiple servlets, one of them being Spring MVC\u2019s DispatcherServlet.\u00a0(DispatcherServlet\u00a0is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.)\n\nSpecifically, an application is vulnerable when all of the following are true:\n\n  *  Spring MVC is on the classpath\n  *  Spring Security is securing more than one servlet in a single application (one of them being Spring MVC\u2019s DispatcherServlet)\n  *  The application uses requestMatchers(String)\u00a0to refer to endpoints that are not Spring MVC endpoints\n\n\nAn application is not vulnerable if any of the following is true:\n\n  *  The application does not have Spring MVC on the classpath\n  *  The application secures no servlets other than Spring MVC\u2019s DispatcherServlet\n  *  The application uses requestMatchers(String)\u00a0only for Spring MVC endpoints",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-34035"
    },
    {
      "cve": "CVE-2023-35945",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy\u2019s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-35945"
    },
    {
      "cve": "CVE-2023-38039",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "When curl retrieves an HTTP response, it stores the incoming headers so that\nthey can be accessed later via the libcurl headers API.\n\nHowever, curl did not have a limit in how many or how large headers it would\naccept in a response, allowing a malicious server to stream an endless series\nof headers and eventually cause curl to run out of heap memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-38039"
    },
    {
      "cve": "CVE-2023-38199",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka \"Content-Type confusion\" between the WAF and the backend application. This occurs when the web application relies on only the last Content-Type header. Other platforms may reject the additional Content-Type header or merge conflicting headers, leading to detection as a malformed header.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-38199"
    },
    {
      "cve": "CVE-2023-38545",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.\r\n\r\nWhen curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255 bytes.\r\n\r\nIf the hostname is detected to be longer than 255 bytes, curl switches to local name resolving and instead passes on the resolved address only to the proxy. Due to a bug, the local variable that means \"let the host resolve the name\" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long hostname to the target buffer instead of copying just the resolved address there.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-38545"
    },
    {
      "cve": "CVE-2023-38546",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "This flaw allows an attacker to insert cookies at will into a running program\nusing libcurl, if the specific series of conditions are met.\n\nlibcurl performs transfers. In its API, an application creates \"easy handles\"\nthat are the individual handles for single transfers.\n\nlibcurl provides a function call that duplicates en easy handle called\n[curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).\n\nIf a transfer has cookies enabled when the handle is duplicated, the\ncookie-enable state is also cloned - but without cloning the actual\ncookies. If the source handle did not read any cookies from a specific file on\ndisk, the cloned version of the handle would instead store the file name as\n`none` (using the four ASCII letters, no quotes).\n\nSubsequent use of the cloned handle that does not explicitly set a source to\nload cookies from would then inadvertently load cookies from a file named\n`none` - if such a file exists and is readable in the current directory of the\nprogram using libcurl. And if using the correct file format of course.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-38546"
    },
    {
      "cve": "CVE-2023-39417",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, \u0027\u0027, or \"\"). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-39417"
    },
    {
      "cve": "CVE-2023-39418",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-39418"
    },
    {
      "cve": "CVE-2023-41080",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92.\n\nThe vulnerability is limited to the ROOT (default) web application.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-41080"
    },
    {
      "cve": "CVE-2023-46120",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects.  Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from  DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-46120"
    },
    {
      "cve": "CVE-2024-23810",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application is vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-23810"
    },
    {
      "cve": "CVE-2024-23811",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-23811"
    },
    {
      "cve": "CVE-2024-23812",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application incorrectly neutralizes special elements when creating a report which could lead to command injection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-23812"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting these vulnerabilities to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SCALANCE XB-200/XC-200/XP-200/XF-200BA/XR-300WG Family before V4.5 is affected by multiple vulnerabilities.\n\nSiemens has released updates for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-699386.json"
      },
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-699386.html"
      },
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-699386.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-699386.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-320-08 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-320-08.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-320-08 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-08"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens SCALANCE Family Products",
    "tracking": {
      "current_release_date": "2023-11-14T00:00:00Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1"
        }
      },
      "id": "ICSA-23-320-08",
      "initial_release_date": "2023-11-14T00:00:00Z",
      "revision_history": [
        {
          "date": "2023-11-14T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (SC, PN) (6GK5205-3BB00-2AB2)",
                  "product_id": "1",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BB00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (SC, PN) (6GK5205-3BB00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BB00-2TB2)",
                  "product_id": "2",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BB00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BB00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BD00-2TB2)",
                  "product_id": "3",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BD00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BD00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (ST, PN) (6GK5205-3BD00-2AB2)",
                  "product_id": "4",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BD00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (ST, PN) (6GK5205-3BD00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3LD (SC, E/IP) (6GK5205-3BF00-2TB2)",
                  "product_id": "5",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BF00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3LD (SC, E/IP) (6GK5205-3BF00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3LD (SC, PN) (6GK5205-3BF00-2AB2)",
                  "product_id": "6",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BF00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3LD (SC, PN) (6GK5205-3BF00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB208 (E/IP) (6GK5208-0BA00-2TB2)",
                  "product_id": "7",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB208 (E/IP) (6GK5208-0BA00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB208 (PN) (6GK5208-0BA00-2AB2)",
                  "product_id": "8",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB208 (PN) (6GK5208-0BA00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (SC, E/IP) (6GK5213-3BD00-2TB2)",
                  "product_id": "9",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BD00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (SC, E/IP) (6GK5213-3BD00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (SC, PN) (6GK5213-3BD00-2AB2)",
                  "product_id": "10",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BD00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (SC, PN) (6GK5213-3BD00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (ST, E/IP) (6GK5213-3BB00-2TB2)",
                  "product_id": "11",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BB00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (ST, E/IP) (6GK5213-3BB00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (ST, PN) (6GK5213-3BB00-2AB2)",
                  "product_id": "12",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BB00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (ST, PN) (6GK5213-3BB00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3LD (SC, E/IP) (6GK5213-3BF00-2TB2)",
                  "product_id": "13",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BF00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3LD (SC, E/IP) (6GK5213-3BF00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3LD (SC, PN) (6GK5213-3BF00-2AB2)",
                  "product_id": "14",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BF00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3LD (SC, PN) (6GK5213-3BF00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB216 (E/IP) (6GK5216-0BA00-2TB2)",
                  "product_id": "15",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB216 (E/IP) (6GK5216-0BA00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB216 (PN) (6GK5216-0BA00-2AB2)",
                  "product_id": "16",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB216 (PN) (6GK5216-0BA00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2 (SC) (6GK5206-2BD00-2AC2)",
                  "product_id": "17",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BD00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2 (SC) (6GK5206-2BD00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2 (ST/BFOC) (6GK5206-2BB00-2AC2)",
                  "product_id": "18",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BB00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2 (ST/BFOC) (6GK5206-2BB00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2G PoE (6GK5206-2RS00-2AC2)",
                  "product_id": "19",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2RS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2G PoE (6GK5206-2RS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2G PoE (54 V DC) (6GK5206-2RS00-5AC2)",
                  "product_id": "20",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2RS00-5AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2G PoE (54 V DC) (6GK5206-2RS00-5AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2G PoE EEC (54 V DC) (6GK5206-2RS00-5FC2)",
                  "product_id": "21",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2RS00-5FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2G PoE EEC (54 V DC) (6GK5206-2RS00-5FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP (6GK5206-2BS00-2AC2)",
                  "product_id": "22",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP (6GK5206-2BS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP EEC (6GK5206-2BS00-2FC2)",
                  "product_id": "23",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP EEC (6GK5206-2BS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP G (6GK5206-2GS00-2AC2)",
                  "product_id": "24",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2GS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP G (6GK5206-2GS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP G (EIP DEF.) (6GK5206-2GS00-2TC2)",
                  "product_id": "25",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2GS00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP G (EIP DEF.) (6GK5206-2GS00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP G EEC (6GK5206-2GS00-2FC2)",
                  "product_id": "26",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2GS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP G EEC (6GK5206-2GS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208 (6GK5208-0BA00-2AC2)",
                  "product_id": "27",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208 (6GK5208-0BA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208EEC (6GK5208-0BA00-2FC2)",
                  "product_id": "28",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208EEC (6GK5208-0BA00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G (6GK5208-0GA00-2AC2)",
                  "product_id": "29",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0GA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G (6GK5208-0GA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G (EIP def.) (6GK5208-0GA00-2TC2)",
                  "product_id": "30",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0GA00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G (EIP def.) (6GK5208-0GA00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G EEC (6GK5208-0GA00-2FC2)",
                  "product_id": "31",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0GA00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G EEC (6GK5208-0GA00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G PoE (6GK5208-0RA00-2AC2)",
                  "product_id": "32",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0RA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G PoE (6GK5208-0RA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G PoE (54 V DC) (6GK5208-0RA00-5AC2)",
                  "product_id": "33",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0RA00-5AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G PoE (54 V DC) (6GK5208-0RA00-5AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216 (6GK5216-0BA00-2AC2)",
                  "product_id": "34",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216 (6GK5216-0BA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-3G PoE (6GK5216-3RS00-2AC2)",
                  "product_id": "35",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-3RS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-3G PoE (6GK5216-3RS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-3G PoE (54 V DC) (6GK5216-3RS00-5AC2)",
                  "product_id": "36",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-3RS00-5AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-3G PoE (54 V DC) (6GK5216-3RS00-5AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C (6GK5216-4BS00-2AC2)",
                  "product_id": "37",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4BS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C (6GK5216-4BS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C G (6GK5216-4GS00-2AC2)",
                  "product_id": "38",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4GS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C G (6GK5216-4GS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C G (EIP Def.) (6GK5216-4GS00-2TC2)",
                  "product_id": "39",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4GS00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C G (EIP Def.) (6GK5216-4GS00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C G EEC (6GK5216-4GS00-2FC2)",
                  "product_id": "40",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4GS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C G EEC (6GK5216-4GS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216EEC (6GK5216-0BA00-2FC2)",
                  "product_id": "41",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216EEC (6GK5216-0BA00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224 (6GK5224-0BA00-2AC2)",
                  "product_id": "42",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-0BA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224 (6GK5224-0BA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224-4C G (6GK5224-4GS00-2AC2)",
                  "product_id": "43",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-4GS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224-4C G (6GK5224-4GS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224-4C G (EIP Def.) (6GK5224-4GS00-2TC2)",
                  "product_id": "44",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-4GS00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224-4C G (EIP Def.) (6GK5224-4GS00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224-4C G EEC (6GK5224-4GS00-2FC2)",
                  "product_id": "45",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-4GS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224-4C G EEC (6GK5224-4GS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204 (6GK5204-0BA00-2GF2)",
                  "product_id": "46",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-0BA00-2GF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204 (6GK5204-0BA00-2GF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204 DNA (6GK5204-0BA00-2YF2)",
                  "product_id": "47",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-0BA00-2YF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204 DNA (6GK5204-0BA00-2YF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204-2BA (6GK5204-2AA00-2GF2)",
                  "product_id": "48",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-2AA00-2GF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204-2BA (6GK5204-2AA00-2GF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204-2BA DNA (6GK5204-2AA00-2YF2)",
                  "product_id": "49",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-2AA00-2YF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204-2BA DNA (6GK5204-2AA00-2YF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208 (6GK5208-0HA00-2AS6)",
                  "product_id": "50",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0HA00-2AS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208 (6GK5208-0HA00-2AS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208 (Ethernet/IP) (6GK5208-0HA00-2TS6)",
                  "product_id": "51",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0HA00-2TS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208 (Ethernet/IP) (6GK5208-0HA00-2TS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208EEC (6GK5208-0HA00-2ES6)",
                  "product_id": "52",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0HA00-2ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208EEC (6GK5208-0HA00-2ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208PoE EEC (6GK5208-0UA00-5ES6)",
                  "product_id": "53",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0UA00-5ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208PoE EEC (6GK5208-0UA00-5ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216 (6GK5216-0HA00-2AS6)",
                  "product_id": "54",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0HA00-2AS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216 (6GK5216-0HA00-2AS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216 (Ethernet/IP) (6GK5216-0HA00-2TS6)",
                  "product_id": "55",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0HA00-2TS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216 (Ethernet/IP) (6GK5216-0HA00-2TS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216EEC (6GK5216-0HA00-2ES6)",
                  "product_id": "56",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0HA00-2ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216EEC (6GK5216-0HA00-2ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216POE EEC (6GK5216-0UA00-5ES6)",
                  "product_id": "57",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0UA00-5ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216POE EEC (6GK5216-0UA00-5ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR324WG (24 x FE, AC 230V) (6GK5324-0BA00-3AR3)",
                  "product_id": "58",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5324-0BA00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR324WG (24 x FE, AC 230V) (6GK5324-0BA00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR324WG (24 X FE, DC 24V) (6GK5324-0BA00-2AR3)",
                  "product_id": "59",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5324-0BA00-2AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR324WG (24 X FE, DC 24V) (6GK5324-0BA00-2AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR326-2C PoE WG (6GK5326-2QS00-3AR3)",
                  "product_id": "60",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5326-2QS00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR326-2C PoE WG (6GK5326-2QS00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR326-2C PoE WG (without UL) (6GK5326-2QS00-3RR3)",
                  "product_id": "61",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5326-2QS00-3RR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR326-2C PoE WG (without UL) (6GK5326-2QS00-3RR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3AR3)",
                  "product_id": "62",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3RR3)",
                  "product_id": "63",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-3RR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3RR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24XFE, 4XGE, 24V) (6GK5328-4FS00-2AR3)",
                  "product_id": "64",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-2AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24XFE, 4XGE, 24V) (6GK5328-4FS00-2AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24xFE, 4xGE,DC24V) (6GK5328-4FS00-2RR3)",
                  "product_id": "65",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-2RR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24xFE, 4xGE,DC24V) (6GK5328-4FS00-2RR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (28xGE, AC 230V) (6GK5328-4SS00-3AR3)",
                  "product_id": "66",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4SS00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (28xGE, AC 230V) (6GK5328-4SS00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (28xGE, DC 24V) (6GK5328-4SS00-2AR3)",
                  "product_id": "67",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4SS00-2AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (28xGE, DC 24V) (6GK5328-4SS00-2AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC206-2 (6AG1206-2BB00-7AC2)",
                  "product_id": "68",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1206-2BB00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC206-2 (6AG1206-2BB00-7AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC206-2SFP (6AG1206-2BS00-7AC2)",
                  "product_id": "69",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1206-2BS00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC206-2SFP (6AG1206-2BS00-7AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC208 (6AG1208-0BA00-7AC2)",
                  "product_id": "70",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1208-0BA00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC208 (6AG1208-0BA00-7AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC216-4C (6AG1216-4BS00-7AC2)",
                  "product_id": "71",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1216-4BS00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC216-4C (6AG1216-4BS00-7AC2)"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4203",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. The read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2022-4203"
    },
    {
      "cve": "CVE-2022-4304",
      "cwe": {
        "id": "CWE-326",
        "name": "Inadequate Encryption Strength"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2022-4304"
    },
    {
      "cve": "CVE-2022-4450",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data. If the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2022-4450"
    },
    {
      "cve": "CVE-2023-0216",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-0216"
    },
    {
      "cve": "CVE-2023-0217",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-0217"
    },
    {
      "cve": "CVE-2023-0401",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-0401"
    },
    {
      "cve": "CVE-2023-2650",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(square(n)) with \u0027n\u0027 being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer\u0027s certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-2650"
    },
    {
      "cve": "CVE-2023-44317",
      "cwe": {
        "id": "CWE-349",
        "name": "Acceptance of Extraneous Untrusted Data With Trusted Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected products do not properly validate the content of uploaded X509 certificates which could allow an attacker with administrative privileges to execute arbitrary code on the device.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44317"
    },
    {
      "cve": "CVE-2023-44318",
      "cwe": {
        "id": "CWE-321",
        "name": "Use of Hard-coded Cryptographic Key"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with administrative privileges or an attacker that obtains a configuration backup to extract configuration information from the exported file.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44318"
    },
    {
      "cve": "CVE-2023-44319",
      "cwe": {
        "id": "CWE-328",
        "name": "Use of Weak Hash"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices use a weak checksum algorithm to protect the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with administrative privileges or an attacker that tricks a legitimate administrator to upload a modified configuration file to change the configuration of an affected device.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44319"
    },
    {
      "cve": "CVE-2023-44320",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request (\u0027Forced Browsing\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices do not properly validate the authentication when performing certain modifications in the web interface allowing an authenticated attacker to influence the user interface configured by an administrator.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44320"
    },
    {
      "cve": "CVE-2023-44321",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices do not properly validate the length of inputs when performing certain configuration changes in the web interface allowing an authenticated attacker to cause a denial of service condition. The device needs to be restarted for the web interface to become available again.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44321"
    },
    {
      "cve": "CVE-2023-44322",
      "cwe": {
        "id": "CWE-252",
        "name": "Unchecked Return Value"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices can be configured to send emails when certain events occur on the device. When presented with an invalid response from the SMTP server, the device triggers an error that disrupts email sending. An attacker with access to the network can use this to do disable notification of users when certain events occur.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44322"
    },
    {
      "cve": "CVE-2023-44373",
      "cwe": {
        "id": "CWE-74",
        "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices do not properly sanitize an input field.  This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell. Follow-up of CVE-2022-36323.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44373"
    },
    {
      "cve": "CVE-2023-44374",
      "cwe": {
        "id": "CWE-567",
        "name": "Unsynchronized Access to Shared Data in a Multithreaded Context"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices allow to change the password, but insufficiently check which password is to be changed. With this  an authenticated attacker could, under certain conditions, be able to change the password of another, potential admin user allowing her to escalate her privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44374"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "ICONICS",
        "summary": "reporting these vulnerabilities to CISA"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could result in information disclosure, denial-of-service, or remote code execution.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Critical Manufacturing",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "ICONICS is headquartered in the United States. Mitsubishi Electric is headquartered in Japan.",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolating them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-229-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-229-01.json"
      },
      {
        "category": "self",
        "summary": "ICSA Advisory ICSA-23-229-01 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-229-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "ICONICS and Mitsubishi Electric Products",
    "tracking": {
      "current_release_date": "2023-08-17T06:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-23-229-01",
      "initial_release_date": "2023-08-17T06:00:00.000000Z",
      "revision_history": [
        {
          "date": "2023-08-17T06:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "Initial Publication"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.97.2",
                "product": {
                  "name": "ICONICS Suite including GENESIS64, Hyper Historian, AnalytiX, and MobileHMI: 10.97.2",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "ICONICS Suite including GENESIS64, Hyper Historian, AnalytiX, and MobileHMI"
          }
        ],
        "category": "vendor",
        "name": "ICONICS, Mitsubishi Electric"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-3602",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A denial of service and potential crash vulnerability due to a buffer overrun condition exists in the OpenSSL library used in the ICONICS Suite. This vulnerability is in the X.509 certificate name constraint checking.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3602"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Version 10.97.2 Critical Fixes Rollup 2 and later is not vulnerable to these exploits. ICONICS recommends that users of its products take the following mitigation steps:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure the 10.97.2 Critical Fixes Rollup release is applied to version 10.97.2 systems.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For systems that do not contain the patch/fix:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not use the BACnet/SC feature on a production system.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric recommend updating the ICONICS Suite with the latest security patches as they become available. ICONICS Suite security patches may be found here (login required).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://partners.iconics.com/Home.aspx"
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing security updates as critical fixes/rollups release. For more information, refer to the ICONICS whitepaper on security vulnerabilities, the most recent version of which can be found here.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information about the security updates may also be found in Mitsubishi Electric\u0027s security advisories:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Advisory 2022-014",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdf"
        },
        {
          "category": "mitigation",
          "details": "Advisory 2023-009",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-009_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-3786",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A denial-of-service vulnerability due to a buffer overrun condition exists in the OpenSSL library used in the ICONICS Suite. This vulnerability is in the X.509 certificate verification.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3786"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Version 10.97.2 Critical Fixes Rollup 2 and later is not vulnerable to these exploits. ICONICS recommends that users of its products take the following mitigation steps:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure the 10.97.2 Critical Fixes Rollup release is applied to version 10.97.2 systems.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For systems that do not contain the patch/fix:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not use the BACnet/SC feature on a production system.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric recommend updating the ICONICS Suite with the latest security patches as they become available. ICONICS Suite security patches may be found here (login required).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://partners.iconics.com/Home.aspx"
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing security updates as critical fixes/rollups release. For more information, refer to the ICONICS whitepaper on security vulnerabilities, the most recent version of which can be found here.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information about the security updates may also be found in Mitsubishi Electric\u0027s security advisories:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Advisory 2022-014",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdf"
        },
        {
          "category": "mitigation",
          "details": "Advisory 2023-009",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-009_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-4203",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A denial-of-service vulnerability due to an out of bounds read condition exists in the OpenSSL library used in the ICONICS Suite. This vulnerability is in the X.509 certificate verification.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4203"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Version 10.97.2 Critical Fixes Rollup 2 and later is not vulnerable to these exploits. ICONICS recommends that users of its products take the following mitigation steps:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure the 10.97.2 Critical Fixes Rollup release is applied to version 10.97.2 systems.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For systems that do not contain the patch/fix:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not use the BACnet/SC feature on a production system.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric recommend updating the ICONICS Suite with the latest security patches as they become available. ICONICS Suite security patches may be found here (login required).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://partners.iconics.com/Home.aspx"
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing security updates as critical fixes/rollups release. For more information, refer to the ICONICS whitepaper on security vulnerabilities, the most recent version of which can be found here.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information about the security updates may also be found in Mitsubishi Electric\u0027s security advisories:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Advisory 2022-014",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdf"
        },
        {
          "category": "mitigation",
          "details": "Advisory 2023-009",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-009_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-4304",
      "cwe": {
        "id": "CWE-208",
        "name": "Observable Timing Discrepancy"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An information disclosure vulnerability due to an observable timing discrepancy exists in the OpenSSL library used in the ICONICS Suite. This vulnerability is in the RSA decryption implementation.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4304"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Version 10.97.2 Critical Fixes Rollup 2 and later is not vulnerable to these exploits. ICONICS recommends that users of its products take the following mitigation steps:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure the 10.97.2 Critical Fixes Rollup release is applied to version 10.97.2 systems.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For systems that do not contain the patch/fix:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not use the BACnet/SC feature on a production system.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric recommend updating the ICONICS Suite with the latest security patches as they become available. ICONICS Suite security patches may be found here (login required).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://partners.iconics.com/Home.aspx"
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing security updates as critical fixes/rollups release. For more information, refer to the ICONICS whitepaper on security vulnerabilities, the most recent version of which can be found here.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information about the security updates may also be found in Mitsubishi Electric\u0027s security advisories:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Advisory 2022-014",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdf"
        },
        {
          "category": "mitigation",
          "details": "Advisory 2023-009",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-009_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-4450",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A denial of service and potential crash vulnerability due to a double free condition exists in the OpenSSL library used in the ICONICS Suite. This vulnerability is in the reading of a PEM file.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4450"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Version 10.97.2 Critical Fixes Rollup 2 and later is not vulnerable to these exploits. ICONICS recommends that users of its products take the following mitigation steps:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure the 10.97.2 Critical Fixes Rollup release is applied to version 10.97.2 systems.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For systems that do not contain the patch/fix:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not use the BACnet/SC feature on a production system.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric recommend updating the ICONICS Suite with the latest security patches as they become available. ICONICS Suite security patches may be found here (login required).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://partners.iconics.com/Home.aspx"
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing security updates as critical fixes/rollups release. For more information, refer to the ICONICS whitepaper on security vulnerabilities, the most recent version of which can be found here.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information about the security updates may also be found in Mitsubishi Electric\u0027s security advisories:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Advisory 2022-014",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdf"
        },
        {
          "category": "mitigation",
          "details": "Advisory 2023-009",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-009_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2023-0401",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A denial of service and potential crash vulnerability due to a NULL Pointer dereference exists in the OpenSSL library used in the ICONICS Suite. This vulnerability can occur when signatures are being verified.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-0401"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Version 10.97.2 Critical Fixes Rollup 2 and later is not vulnerable to these exploits. ICONICS recommends that users of its products take the following mitigation steps:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure the 10.97.2 Critical Fixes Rollup release is applied to version 10.97.2 systems.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For systems that do not contain the patch/fix:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not use the BACnet/SC feature on a production system.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric recommend updating the ICONICS Suite with the latest security patches as they become available. ICONICS Suite security patches may be found here (login required).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://partners.iconics.com/Home.aspx"
        },
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing security updates as critical fixes/rollups release. For more information, refer to the ICONICS whitepaper on security vulnerabilities, the most recent version of which can be found here.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information about the security updates may also be found in Mitsubishi Electric\u0027s security advisories:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Advisory 2022-014",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdf"
        },
        {
          "category": "mitigation",
          "details": "Advisory 2023-009",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-009_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting these vulnerabilities to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SCALANCE XB-200/XC-200/XP-200/XF-200BA/XR-300WG Family before V4.5 is affected by multiple vulnerabilities.\n\nSiemens has released updates for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-699386.json"
      },
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-699386.html"
      },
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-699386.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-699386.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-320-08 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-320-08.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-320-08 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-08"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens SCALANCE Family Products",
    "tracking": {
      "current_release_date": "2023-11-14T00:00:00Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1"
        }
      },
      "id": "ICSA-23-320-08",
      "initial_release_date": "2023-11-14T00:00:00Z",
      "revision_history": [
        {
          "date": "2023-11-14T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (SC, PN) (6GK5205-3BB00-2AB2)",
                  "product_id": "1",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BB00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (SC, PN) (6GK5205-3BB00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BB00-2TB2)",
                  "product_id": "2",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BB00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BB00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BD00-2TB2)",
                  "product_id": "3",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BD00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BD00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3 (ST, PN) (6GK5205-3BD00-2AB2)",
                  "product_id": "4",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BD00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3 (ST, PN) (6GK5205-3BD00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3LD (SC, E/IP) (6GK5205-3BF00-2TB2)",
                  "product_id": "5",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BF00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3LD (SC, E/IP) (6GK5205-3BF00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB205-3LD (SC, PN) (6GK5205-3BF00-2AB2)",
                  "product_id": "6",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5205-3BF00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB205-3LD (SC, PN) (6GK5205-3BF00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB208 (E/IP) (6GK5208-0BA00-2TB2)",
                  "product_id": "7",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB208 (E/IP) (6GK5208-0BA00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB208 (PN) (6GK5208-0BA00-2AB2)",
                  "product_id": "8",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB208 (PN) (6GK5208-0BA00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (SC, E/IP) (6GK5213-3BD00-2TB2)",
                  "product_id": "9",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BD00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (SC, E/IP) (6GK5213-3BD00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (SC, PN) (6GK5213-3BD00-2AB2)",
                  "product_id": "10",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BD00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (SC, PN) (6GK5213-3BD00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (ST, E/IP) (6GK5213-3BB00-2TB2)",
                  "product_id": "11",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BB00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (ST, E/IP) (6GK5213-3BB00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3 (ST, PN) (6GK5213-3BB00-2AB2)",
                  "product_id": "12",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BB00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3 (ST, PN) (6GK5213-3BB00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3LD (SC, E/IP) (6GK5213-3BF00-2TB2)",
                  "product_id": "13",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BF00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3LD (SC, E/IP) (6GK5213-3BF00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB213-3LD (SC, PN) (6GK5213-3BF00-2AB2)",
                  "product_id": "14",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5213-3BF00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB213-3LD (SC, PN) (6GK5213-3BF00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB216 (E/IP) (6GK5216-0BA00-2TB2)",
                  "product_id": "15",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2TB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB216 (E/IP) (6GK5216-0BA00-2TB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XB216 (PN) (6GK5216-0BA00-2AB2)",
                  "product_id": "16",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2AB2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XB216 (PN) (6GK5216-0BA00-2AB2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2 (SC) (6GK5206-2BD00-2AC2)",
                  "product_id": "17",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BD00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2 (SC) (6GK5206-2BD00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2 (ST/BFOC) (6GK5206-2BB00-2AC2)",
                  "product_id": "18",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BB00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2 (ST/BFOC) (6GK5206-2BB00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2G PoE (6GK5206-2RS00-2AC2)",
                  "product_id": "19",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2RS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2G PoE (6GK5206-2RS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2G PoE (54 V DC) (6GK5206-2RS00-5AC2)",
                  "product_id": "20",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2RS00-5AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2G PoE (54 V DC) (6GK5206-2RS00-5AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2G PoE EEC (54 V DC) (6GK5206-2RS00-5FC2)",
                  "product_id": "21",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2RS00-5FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2G PoE EEC (54 V DC) (6GK5206-2RS00-5FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP (6GK5206-2BS00-2AC2)",
                  "product_id": "22",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP (6GK5206-2BS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP EEC (6GK5206-2BS00-2FC2)",
                  "product_id": "23",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2BS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP EEC (6GK5206-2BS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP G (6GK5206-2GS00-2AC2)",
                  "product_id": "24",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2GS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP G (6GK5206-2GS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP G (EIP DEF.) (6GK5206-2GS00-2TC2)",
                  "product_id": "25",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2GS00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP G (EIP DEF.) (6GK5206-2GS00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC206-2SFP G EEC (6GK5206-2GS00-2FC2)",
                  "product_id": "26",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5206-2GS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC206-2SFP G EEC (6GK5206-2GS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208 (6GK5208-0BA00-2AC2)",
                  "product_id": "27",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208 (6GK5208-0BA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208EEC (6GK5208-0BA00-2FC2)",
                  "product_id": "28",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0BA00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208EEC (6GK5208-0BA00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G (6GK5208-0GA00-2AC2)",
                  "product_id": "29",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0GA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G (6GK5208-0GA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G (EIP def.) (6GK5208-0GA00-2TC2)",
                  "product_id": "30",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0GA00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G (EIP def.) (6GK5208-0GA00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G EEC (6GK5208-0GA00-2FC2)",
                  "product_id": "31",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0GA00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G EEC (6GK5208-0GA00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G PoE (6GK5208-0RA00-2AC2)",
                  "product_id": "32",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0RA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G PoE (6GK5208-0RA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC208G PoE (54 V DC) (6GK5208-0RA00-5AC2)",
                  "product_id": "33",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0RA00-5AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC208G PoE (54 V DC) (6GK5208-0RA00-5AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216 (6GK5216-0BA00-2AC2)",
                  "product_id": "34",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216 (6GK5216-0BA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-3G PoE (6GK5216-3RS00-2AC2)",
                  "product_id": "35",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-3RS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-3G PoE (6GK5216-3RS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-3G PoE (54 V DC) (6GK5216-3RS00-5AC2)",
                  "product_id": "36",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-3RS00-5AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-3G PoE (54 V DC) (6GK5216-3RS00-5AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C (6GK5216-4BS00-2AC2)",
                  "product_id": "37",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4BS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C (6GK5216-4BS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C G (6GK5216-4GS00-2AC2)",
                  "product_id": "38",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4GS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C G (6GK5216-4GS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C G (EIP Def.) (6GK5216-4GS00-2TC2)",
                  "product_id": "39",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4GS00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C G (EIP Def.) (6GK5216-4GS00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216-4C G EEC (6GK5216-4GS00-2FC2)",
                  "product_id": "40",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-4GS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216-4C G EEC (6GK5216-4GS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC216EEC (6GK5216-0BA00-2FC2)",
                  "product_id": "41",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0BA00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC216EEC (6GK5216-0BA00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224 (6GK5224-0BA00-2AC2)",
                  "product_id": "42",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-0BA00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224 (6GK5224-0BA00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224-4C G (6GK5224-4GS00-2AC2)",
                  "product_id": "43",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-4GS00-2AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224-4C G (6GK5224-4GS00-2AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224-4C G (EIP Def.) (6GK5224-4GS00-2TC2)",
                  "product_id": "44",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-4GS00-2TC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224-4C G (EIP Def.) (6GK5224-4GS00-2TC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XC224-4C G EEC (6GK5224-4GS00-2FC2)",
                  "product_id": "45",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5224-4GS00-2FC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XC224-4C G EEC (6GK5224-4GS00-2FC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204 (6GK5204-0BA00-2GF2)",
                  "product_id": "46",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-0BA00-2GF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204 (6GK5204-0BA00-2GF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204 DNA (6GK5204-0BA00-2YF2)",
                  "product_id": "47",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-0BA00-2YF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204 DNA (6GK5204-0BA00-2YF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204-2BA (6GK5204-2AA00-2GF2)",
                  "product_id": "48",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-2AA00-2GF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204-2BA (6GK5204-2AA00-2GF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XF204-2BA DNA (6GK5204-2AA00-2YF2)",
                  "product_id": "49",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5204-2AA00-2YF2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XF204-2BA DNA (6GK5204-2AA00-2YF2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208 (6GK5208-0HA00-2AS6)",
                  "product_id": "50",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0HA00-2AS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208 (6GK5208-0HA00-2AS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208 (Ethernet/IP) (6GK5208-0HA00-2TS6)",
                  "product_id": "51",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0HA00-2TS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208 (Ethernet/IP) (6GK5208-0HA00-2TS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208EEC (6GK5208-0HA00-2ES6)",
                  "product_id": "52",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0HA00-2ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208EEC (6GK5208-0HA00-2ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP208PoE EEC (6GK5208-0UA00-5ES6)",
                  "product_id": "53",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5208-0UA00-5ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP208PoE EEC (6GK5208-0UA00-5ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216 (6GK5216-0HA00-2AS6)",
                  "product_id": "54",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0HA00-2AS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216 (6GK5216-0HA00-2AS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216 (Ethernet/IP) (6GK5216-0HA00-2TS6)",
                  "product_id": "55",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0HA00-2TS6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216 (Ethernet/IP) (6GK5216-0HA00-2TS6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216EEC (6GK5216-0HA00-2ES6)",
                  "product_id": "56",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0HA00-2ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216EEC (6GK5216-0HA00-2ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XP216POE EEC (6GK5216-0UA00-5ES6)",
                  "product_id": "57",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5216-0UA00-5ES6"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XP216POE EEC (6GK5216-0UA00-5ES6)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR324WG (24 x FE, AC 230V) (6GK5324-0BA00-3AR3)",
                  "product_id": "58",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5324-0BA00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR324WG (24 x FE, AC 230V) (6GK5324-0BA00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR324WG (24 X FE, DC 24V) (6GK5324-0BA00-2AR3)",
                  "product_id": "59",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5324-0BA00-2AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR324WG (24 X FE, DC 24V) (6GK5324-0BA00-2AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR326-2C PoE WG (6GK5326-2QS00-3AR3)",
                  "product_id": "60",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5326-2QS00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR326-2C PoE WG (6GK5326-2QS00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR326-2C PoE WG (without UL) (6GK5326-2QS00-3RR3)",
                  "product_id": "61",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5326-2QS00-3RR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR326-2C PoE WG (without UL) (6GK5326-2QS00-3RR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3AR3)",
                  "product_id": "62",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3RR3)",
                  "product_id": "63",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-3RR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3RR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24XFE, 4XGE, 24V) (6GK5328-4FS00-2AR3)",
                  "product_id": "64",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-2AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24XFE, 4XGE, 24V) (6GK5328-4FS00-2AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (24xFE, 4xGE,DC24V) (6GK5328-4FS00-2RR3)",
                  "product_id": "65",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4FS00-2RR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (24xFE, 4xGE,DC24V) (6GK5328-4FS00-2RR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (28xGE, AC 230V) (6GK5328-4SS00-3AR3)",
                  "product_id": "66",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4SS00-3AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (28xGE, AC 230V) (6GK5328-4SS00-3AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SCALANCE XR328-4C WG (28xGE, DC 24V) (6GK5328-4SS00-2AR3)",
                  "product_id": "67",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK5328-4SS00-2AR3"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE XR328-4C WG (28xGE, DC 24V) (6GK5328-4SS00-2AR3)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC206-2 (6AG1206-2BB00-7AC2)",
                  "product_id": "68",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1206-2BB00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC206-2 (6AG1206-2BB00-7AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC206-2SFP (6AG1206-2BS00-7AC2)",
                  "product_id": "69",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1206-2BS00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC206-2SFP (6AG1206-2BS00-7AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC208 (6AG1208-0BA00-7AC2)",
                  "product_id": "70",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1208-0BA00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC208 (6AG1208-0BA00-7AC2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.5",
                "product": {
                  "name": "SIPLUS NET SCALANCE XC216-4C (6AG1216-4BS00-7AC2)",
                  "product_id": "71",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6AG1216-4BS00-7AC2"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS NET SCALANCE XC216-4C (6AG1216-4BS00-7AC2)"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4203",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. The read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2022-4203"
    },
    {
      "cve": "CVE-2022-4304",
      "cwe": {
        "id": "CWE-326",
        "name": "Inadequate Encryption Strength"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2022-4304"
    },
    {
      "cve": "CVE-2022-4450",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data. If the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2022-4450"
    },
    {
      "cve": "CVE-2023-0216",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-0216"
    },
    {
      "cve": "CVE-2023-0217",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-0217"
    },
    {
      "cve": "CVE-2023-0401",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-0401"
    },
    {
      "cve": "CVE-2023-2650",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(square(n)) with \u0027n\u0027 being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer\u0027s certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-2650"
    },
    {
      "cve": "CVE-2023-44317",
      "cwe": {
        "id": "CWE-349",
        "name": "Acceptance of Extraneous Untrusted Data With Trusted Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected products do not properly validate the content of uploaded X509 certificates which could allow an attacker with administrative privileges to execute arbitrary code on the device.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44317"
    },
    {
      "cve": "CVE-2023-44318",
      "cwe": {
        "id": "CWE-321",
        "name": "Use of Hard-coded Cryptographic Key"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with administrative privileges or an attacker that obtains a configuration backup to extract configuration information from the exported file.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44318"
    },
    {
      "cve": "CVE-2023-44319",
      "cwe": {
        "id": "CWE-328",
        "name": "Use of Weak Hash"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices use a weak checksum algorithm to protect the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with administrative privileges or an attacker that tricks a legitimate administrator to upload a modified configuration file to change the configuration of an affected device.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44319"
    },
    {
      "cve": "CVE-2023-44320",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request (\u0027Forced Browsing\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices do not properly validate the authentication when performing certain modifications in the web interface allowing an authenticated attacker to influence the user interface configured by an administrator.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44320"
    },
    {
      "cve": "CVE-2023-44321",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices do not properly validate the length of inputs when performing certain configuration changes in the web interface allowing an authenticated attacker to cause a denial of service condition. The device needs to be restarted for the web interface to become available again.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44321"
    },
    {
      "cve": "CVE-2023-44322",
      "cwe": {
        "id": "CWE-252",
        "name": "Unchecked Return Value"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices can be configured to send emails when certain events occur on the device. When presented with an invalid response from the SMTP server, the device triggers an error that disrupts email sending. An attacker with access to the network can use this to do disable notification of users when certain events occur.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44322"
    },
    {
      "cve": "CVE-2023-44373",
      "cwe": {
        "id": "CWE-74",
        "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices do not properly sanitize an input field.  This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell. Follow-up of CVE-2022-36323.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44373"
    },
    {
      "cve": "CVE-2023-44374",
      "cwe": {
        "id": "CWE-567",
        "name": "Unsynchronized Access to Shared Data in a Multithreaded Context"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices allow to change the password, but insufficiently check which password is to be changed. With this  an authenticated attacker could, under certain conditions, be able to change the password of another, potential admin user allowing her to escalate her privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "30",
          "31",
          "32",
          "33",
          "34",
          "35",
          "36",
          "37",
          "38",
          "39",
          "40",
          "41",
          "42",
          "43",
          "44",
          "45",
          "46",
          "47",
          "48",
          "49",
          "50",
          "51",
          "52",
          "53",
          "54",
          "55",
          "56",
          "57",
          "58",
          "59",
          "60",
          "61",
          "64",
          "65",
          "62",
          "63",
          "66",
          "67",
          "68",
          "69",
          "70",
          "71"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.5 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109825818/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26",
            "27",
            "28",
            "29",
            "30",
            "31",
            "32",
            "33",
            "34",
            "35",
            "36",
            "37",
            "38",
            "39",
            "40",
            "41",
            "42",
            "43",
            "44",
            "45",
            "46",
            "47",
            "48",
            "49",
            "50",
            "51",
            "52",
            "53",
            "54",
            "55",
            "56",
            "57",
            "58",
            "59",
            "60",
            "61",
            "64",
            "65",
            "62",
            "63",
            "66",
            "67",
            "68",
            "69",
            "70",
            "71"
          ]
        }
      ],
      "title": "CVE-2023-44374"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting these vulnerabilities to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SINEC NMS before V2.0 SP1 is affected by multiple vulnerabilities.\n\nSiemens has released an update for SINEC NMS and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-943925.json"
      },
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-943925.html"
      },
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-943925.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-943925.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-046-15 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-046-15.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-046-15 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-046-15"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens SINEC NMS",
    "tracking": {
      "current_release_date": "2024-02-13T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1"
        }
      },
      "id": "ICSA-24-046-15",
      "initial_release_date": "2024-02-13T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2024-02-13T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV2.0_SP1",
                "product": {
                  "name": "SINEC NMS",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "SINEC NMS"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4203",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. The read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2022-4203"
    },
    {
      "cve": "CVE-2022-4304",
      "cwe": {
        "id": "CWE-326",
        "name": "Inadequate Encryption Strength"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2022-4304"
    },
    {
      "cve": "CVE-2022-4450",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data. If the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2022-4450"
    },
    {
      "cve": "CVE-2023-0215",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-0215"
    },
    {
      "cve": "CVE-2023-0216",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-0216"
    },
    {
      "cve": "CVE-2023-0217",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-0217"
    },
    {
      "cve": "CVE-2023-0286",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-0286"
    },
    {
      "cve": "CVE-2023-0401",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-0401"
    },
    {
      "cve": "CVE-2023-1255",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM\nplatform contains a bug that could cause it to read past the input buffer,\nleading to a crash.\n\nImpact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM\nplatform can crash in rare circumstances. The AES-XTS algorithm is usually\nused for disk encryption.\n\nThe AES-XTS cipher decryption implementation for 64 bit ARM platform will read\npast the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16\nbyte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext\nbuffer is unmapped, this will trigger a crash which results in a denial of\nservice.\n\nIf an attacker can control the size and location of the ciphertext buffer\nbeing decrypted by an application using AES-XTS on 64 bit ARM, the\napplication is affected. This is fairly unlikely making this issue\na Low severity one.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-1255"
    },
    {
      "cve": "CVE-2023-2454",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-2454"
    },
    {
      "cve": "CVE-2023-2455",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-2455"
    },
    {
      "cve": "CVE-2023-2650",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(square(n)) with \u0027n\u0027 being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer\u0027s certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-2650"
    },
    {
      "cve": "CVE-2023-2975",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be mislead by removing adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-2975"
    },
    {
      "cve": "CVE-2023-3446",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus (\u0027p\u0027 parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the \u0027-check\u0027 option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-3446"
    },
    {
      "cve": "CVE-2023-3817",
      "cwe": {
        "id": "CWE-834",
        "name": "Excessive Iteration"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the \"-check\" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-3817"
    },
    {
      "cve": "CVE-2023-25690",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.\r\n\r\nConfigurations are affected when mod_proxy is enabled along with some form of RewriteRule  or ProxyPassMatch in which a non-specific pattern matches  some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. \r\n\r\nRequest splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-25690"
    },
    {
      "cve": "CVE-2023-27522",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55.\n\nSpecial characters in the origin response header can truncate/split the response forwarded to the client.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-27522"
    },
    {
      "cve": "CVE-2023-27533",
      "cwe": {
        "id": "CWE-74",
        "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application\u0027s intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-27533"
    },
    {
      "cve": "CVE-2023-27534",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A path traversal vulnerability exists in curl \u003c8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user\u0027s home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-27534"
    },
    {
      "cve": "CVE-2023-27535",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An authentication bypass vulnerability exists in libcurl \u003c8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-27535"
    },
    {
      "cve": "CVE-2023-27536",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An authentication bypass vulnerability exists libcurl \u003c8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-27536"
    },
    {
      "cve": "CVE-2023-27537",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-27537"
    },
    {
      "cve": "CVE-2023-27538",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "libcurl would reuse a previously created connection even when an SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, two SSH settings were left out from the configuration match checks, making them match too easily.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-27538"
    },
    {
      "cve": "CVE-2023-28319",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A use after free vulnerability exists in curl \u003cv8.1.0 in the way libcurl offers a feature to verify an SSH server\u0027s public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-28319"
    },
    {
      "cve": "CVE-2023-28320",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-28320"
    },
    {
      "cve": "CVE-2023-28321",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An improper certificate validation vulnerability exists in curl \u003cv8.1.0 in the way it supports matching of wildcard patterns when listed as \"Subject Alternative Name\" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-28321"
    },
    {
      "cve": "CVE-2023-28322",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An information disclosure vulnerability exists in curl \u003cv8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-28322"
    },
    {
      "cve": "CVE-2023-28709",
      "cwe": {
        "id": "CWE-193",
        "name": "Off-by-one Error"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP       connector settings were used such that the maxParameterCount\u00a0could be reached using query string parameters and a request was       submitted that supplied exactly maxParameterCount parameters\u00a0in the query string, the limit for uploaded request parts could be\u00a0bypassed with the potential for a denial of service to occur.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-28709"
    },
    {
      "cve": "CVE-2023-30581",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30581"
    },
    {
      "cve": "CVE-2023-30582",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a result, malicious actors can monitor files that they do not have explicit read access to.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30582"
    },
    {
      "cve": "CVE-2023-30583",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js. This vulnerability arises from a missing check in the fs.openAsBlob() API.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30583"
    },
    {
      "cve": "CVE-2023-30584",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in the experimental permission model of Node.js leads to improper handling of path traversal bypass when verifying file permissions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30584"
    },
    {
      "cve": "CVE-2023-30585",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the \"msiexec.exe\" process, running under the NT AUTHORITY\\SYSTEM context, attempts to read the %USERPROFILE% environment variable from the current user\u0027s registry.\n\nThe issue arises when the path referenced by the %USERPROFILE% environment variable does not exist. In such cases, the \"msiexec.exe\" process attempts to create the specified path in an unsafe manner, potentially leading to the creation of arbitrary folders in arbitrary locations.\n\nThe severity of this vulnerability is heightened by the fact that the %USERPROFILE% environment variable in the Windows registry can be modified by standard (or \"non-privileged\") users. Consequently, unprivileged actors, including malicious entities or trojans, can manipulate the environment variable key to deceive the privileged \"msiexec.exe\" process. This manipulation can result in the creation of folders in unintended and potentially malicious locations.\n\nIt is important to note that this vulnerability is specific to Windows users who install Node.js using the .msi installer. Users who opt for other installation methods are not affected by this particular issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30585"
    },
    {
      "cve": "CVE-2023-30586",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for example, disable the permission model in the host process by manipulating the process\u0027s stack memory to locate the permission model Permission::enabled_ in the host process\u0027s heap memory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30586"
    },
    {
      "cve": "CVE-2023-30587",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in Node.js allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector). By exploiting the Worker class\u0027s ability to create an \"internal worker\" with the kIsInternal Symbol, attackers can modify the isInternal value when an inspector is attached within the Worker constructor before initializing a new WorkerImpl.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30587"
    },
    {
      "cve": "CVE-2023-30588",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30588"
    },
    {
      "cve": "CVE-2023-30589",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).\r\n\r\nThe CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30589"
    },
    {
      "cve": "CVE-2023-30590",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: \"Generates private and public Diffie-Hellman key values\".\n\nThe documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-30590"
    },
    {
      "cve": "CVE-2023-31124",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android.  This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-31124"
    },
    {
      "cve": "CVE-2023-31130",
      "cwe": {
        "id": "CWE-124",
        "name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular \"0::00:00:00/2\" was found to cause an issue.  C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-31130"
    },
    {
      "cve": "CVE-2023-31147",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-31147"
    },
    {
      "cve": "CVE-2023-32002",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\n\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32002"
    },
    {
      "cve": "CVE-2023-32003",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32003"
    },
    {
      "cve": "CVE-2023-32004",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32004"
    },
    {
      "cve": "CVE-2023-32005",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument.\n\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the `fs.statfs` API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32005"
    },
    {
      "cve": "CVE-2023-32006",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\n\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32006"
    },
    {
      "cve": "CVE-2023-32067",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32067"
    },
    {
      "cve": "CVE-2023-32558",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. \n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.x.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32558"
    },
    {
      "cve": "CVE-2023-32559",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding(\u0027spawn_sync\u0027)` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-32559"
    },
    {
      "cve": "CVE-2023-34035",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Spring Security versions 5.8\u00a0prior to 5.8.5, 6.0\u00a0prior to 6.0.5,\u00a0and 6.1\u00a0prior to 6.1.2\u00a0could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String)\u00a0and multiple servlets, one of them being Spring MVC\u2019s DispatcherServlet.\u00a0(DispatcherServlet\u00a0is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.)\n\nSpecifically, an application is vulnerable when all of the following are true:\n\n  *  Spring MVC is on the classpath\n  *  Spring Security is securing more than one servlet in a single application (one of them being Spring MVC\u2019s DispatcherServlet)\n  *  The application uses requestMatchers(String)\u00a0to refer to endpoints that are not Spring MVC endpoints\n\n\nAn application is not vulnerable if any of the following is true:\n\n  *  The application does not have Spring MVC on the classpath\n  *  The application secures no servlets other than Spring MVC\u2019s DispatcherServlet\n  *  The application uses requestMatchers(String)\u00a0only for Spring MVC endpoints",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-34035"
    },
    {
      "cve": "CVE-2023-35945",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy\u2019s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-35945"
    },
    {
      "cve": "CVE-2023-38039",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "When curl retrieves an HTTP response, it stores the incoming headers so that\nthey can be accessed later via the libcurl headers API.\n\nHowever, curl did not have a limit in how many or how large headers it would\naccept in a response, allowing a malicious server to stream an endless series\nof headers and eventually cause curl to run out of heap memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-38039"
    },
    {
      "cve": "CVE-2023-38199",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka \"Content-Type confusion\" between the WAF and the backend application. This occurs when the web application relies on only the last Content-Type header. Other platforms may reject the additional Content-Type header or merge conflicting headers, leading to detection as a malformed header.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-38199"
    },
    {
      "cve": "CVE-2023-38545",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.\r\n\r\nWhen curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255 bytes.\r\n\r\nIf the hostname is detected to be longer than 255 bytes, curl switches to local name resolving and instead passes on the resolved address only to the proxy. Due to a bug, the local variable that means \"let the host resolve the name\" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long hostname to the target buffer instead of copying just the resolved address there.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-38545"
    },
    {
      "cve": "CVE-2023-38546",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "This flaw allows an attacker to insert cookies at will into a running program\nusing libcurl, if the specific series of conditions are met.\n\nlibcurl performs transfers. In its API, an application creates \"easy handles\"\nthat are the individual handles for single transfers.\n\nlibcurl provides a function call that duplicates en easy handle called\n[curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).\n\nIf a transfer has cookies enabled when the handle is duplicated, the\ncookie-enable state is also cloned - but without cloning the actual\ncookies. If the source handle did not read any cookies from a specific file on\ndisk, the cloned version of the handle would instead store the file name as\n`none` (using the four ASCII letters, no quotes).\n\nSubsequent use of the cloned handle that does not explicitly set a source to\nload cookies from would then inadvertently load cookies from a file named\n`none` - if such a file exists and is readable in the current directory of the\nprogram using libcurl. And if using the correct file format of course.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-38546"
    },
    {
      "cve": "CVE-2023-39417",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, \u0027\u0027, or \"\"). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-39417"
    },
    {
      "cve": "CVE-2023-39418",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-39418"
    },
    {
      "cve": "CVE-2023-41080",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92.\n\nThe vulnerability is limited to the ROOT (default) web application.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-41080"
    },
    {
      "cve": "CVE-2023-46120",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects.  Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from  DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-46120"
    },
    {
      "cve": "CVE-2024-23810",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application is vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-23810"
    },
    {
      "cve": "CVE-2024-23811",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-23811"
    },
    {
      "cve": "CVE-2024-23812",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application incorrectly neutralizes special elements when creating a report which could lead to command injection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.0 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109826954/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-23812"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for openssl is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\n[Updated 20 March 2023]\nPreviously, this erratum was marked as having a security impact of Moderate. This was incorrect; the security impact of this erratum has been changed to Important, to correctly reflect the highest impact rating of CVE fixes included in this release. No changes have been made to packages.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)\n\n* openssl: read buffer overflow in X.509 certificate verification (CVE-2022-4203)\n\n* openssl: timing attack in RSA Decryption implementation (CVE-2022-4304)\n\n* openssl: double free after calling PEM_read_bio_ex (CVE-2022-4450)\n\n* openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215)\n\n* openssl: invalid pointer dereference in d2i_PKCS7 functions (CVE-2023-0216)\n\n* openssl: NULL dereference validating DSA public key (CVE-2023-0217)\n\n* openssl: NULL dereference during PKCS7 data verification (CVE-2023-0401)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* HMAC generation should reject key lengths \u003c 112 bits or provide an indicator in FIPS mode (BZ#2144001)\n\n* In FIPS mode, openssl should set a minimum length for passwords in PBKDF2 (BZ#2144004)\n\n* stunnel consumes high amount of memory when pestered with TCP connections without a TLS handshake (BZ#2144009)\n\n* In FIPS mode, openssl should reject SHAKE as digest for RSA-OAEP or provide an indicator (BZ#2144011)\n\n* In FIPS mode, openssl should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator (BZ#2144013)\n\n* In FIPS mode, openssl should reject RSA signatures with X9.31 padding, or provide an indicator (BZ#2144016)\n\n* In FIPS mode, openssl should reject SHA-224, SHA-384, SHA-512-224, and SHA-512-256 as hashes for hash-based DRBGs, or provide an indicator after 2023-05-16 (BZ#2144018)\n\n* In FIPS mode, openssl should reject KDF input and output key lengths \u003c 112 bits or provide an indicator (BZ#2144020)\n\n* In FIPS mode, openssl should reject RSA keys \u003c 2048 bits when using EVP_PKEY_decapsulate, or provide an indicator (BZ#2145171)\n\n* OpenSSL FIPS checksum code needs update (BZ#2158413)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:1199",
        "url": "https://access.redhat.com/errata/RHSA-2023:1199"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2144001",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144001"
      },
      {
        "category": "external",
        "summary": "2144004",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144004"
      },
      {
        "category": "external",
        "summary": "2144007",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144007"
      },
      {
        "category": "external",
        "summary": "2144009",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144009"
      },
      {
        "category": "external",
        "summary": "2144011",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144011"
      },
      {
        "category": "external",
        "summary": "2144013",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144013"
      },
      {
        "category": "external",
        "summary": "2144016",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144016"
      },
      {
        "category": "external",
        "summary": "2144018",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144018"
      },
      {
        "category": "external",
        "summary": "2144020",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144020"
      },
      {
        "category": "external",
        "summary": "2145171",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145171"
      },
      {
        "category": "external",
        "summary": "2158413",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158413"
      },
      {
        "category": "external",
        "summary": "2164440",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164440"
      },
      {
        "category": "external",
        "summary": "2164487",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164487"
      },
      {
        "category": "external",
        "summary": "2164488",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164488"
      },
      {
        "category": "external",
        "summary": "2164492",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164492"
      },
      {
        "category": "external",
        "summary": "2164494",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164494"
      },
      {
        "category": "external",
        "summary": "2164497",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164497"
      },
      {
        "category": "external",
        "summary": "2164499",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164499"
      },
      {
        "category": "external",
        "summary": "2164500",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164500"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1199.json"
      }
    ],
    "title": "Red Hat Security Advisory: openssl security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-25T08:49:22+00:00",
      "generator": {
        "date": "2024-11-25T08:49:22+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2023:1199",
      "initial_release_date": "2023-03-14T13:57:15+00:00",
      "revision_history": [
        {
          "date": "2023-03-14T13:57:15+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-03-21T11:27:46+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-25T08:49:22+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v.9.0)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v.9.0)",
                  "product_id": "AppStream-9.0.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:9.0::appstream"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
                  "product_id": "BaseOS-9.0.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus:9.0::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-devel-1:3.0.1-46.el9_0.aarch64",
                "product": {
                  "name": "openssl-devel-1:3.0.1-46.el9_0.aarch64",
                  "product_id": "openssl-devel-1:3.0.1-46.el9_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-devel@3.0.1-46.el9_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-perl-1:3.0.1-46.el9_0.aarch64",
                "product": {
                  "name": "openssl-perl-1:3.0.1-46.el9_0.aarch64",
                  "product_id": "openssl-perl-1:3.0.1-46.el9_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-perl@3.0.1-46.el9_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
                "product": {
                  "name": "openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
                  "product_id": "openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debugsource@3.0.1-46.el9_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
                "product": {
                  "name": "openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
                  "product_id": "openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debuginfo@3.0.1-46.el9_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
                "product": {
                  "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
                  "product_id": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@3.0.1-46.el9_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-1:3.0.1-46.el9_0.aarch64",
                "product": {
                  "name": "openssl-1:3.0.1-46.el9_0.aarch64",
                  "product_id": "openssl-1:3.0.1-46.el9_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl@3.0.1-46.el9_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-1:3.0.1-46.el9_0.aarch64",
                "product": {
                  "name": "openssl-libs-1:3.0.1-46.el9_0.aarch64",
                  "product_id": "openssl-libs-1:3.0.1-46.el9_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs@3.0.1-46.el9_0?arch=aarch64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-devel-1:3.0.1-46.el9_0.ppc64le",
                "product": {
                  "name": "openssl-devel-1:3.0.1-46.el9_0.ppc64le",
                  "product_id": "openssl-devel-1:3.0.1-46.el9_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-devel@3.0.1-46.el9_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-perl-1:3.0.1-46.el9_0.ppc64le",
                "product": {
                  "name": "openssl-perl-1:3.0.1-46.el9_0.ppc64le",
                  "product_id": "openssl-perl-1:3.0.1-46.el9_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-perl@3.0.1-46.el9_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
                "product": {
                  "name": "openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
                  "product_id": "openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debugsource@3.0.1-46.el9_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
                "product": {
                  "name": "openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
                  "product_id": "openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debuginfo@3.0.1-46.el9_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
                "product": {
                  "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
                  "product_id": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@3.0.1-46.el9_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-1:3.0.1-46.el9_0.ppc64le",
                "product": {
                  "name": "openssl-1:3.0.1-46.el9_0.ppc64le",
                  "product_id": "openssl-1:3.0.1-46.el9_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl@3.0.1-46.el9_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-1:3.0.1-46.el9_0.ppc64le",
                "product": {
                  "name": "openssl-libs-1:3.0.1-46.el9_0.ppc64le",
                  "product_id": "openssl-libs-1:3.0.1-46.el9_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs@3.0.1-46.el9_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-devel-1:3.0.1-46.el9_0.i686",
                "product": {
                  "name": "openssl-devel-1:3.0.1-46.el9_0.i686",
                  "product_id": "openssl-devel-1:3.0.1-46.el9_0.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-devel@3.0.1-46.el9_0?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debugsource-1:3.0.1-46.el9_0.i686",
                "product": {
                  "name": "openssl-debugsource-1:3.0.1-46.el9_0.i686",
                  "product_id": "openssl-debugsource-1:3.0.1-46.el9_0.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debugsource@3.0.1-46.el9_0?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debuginfo-1:3.0.1-46.el9_0.i686",
                "product": {
                  "name": "openssl-debuginfo-1:3.0.1-46.el9_0.i686",
                  "product_id": "openssl-debuginfo-1:3.0.1-46.el9_0.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debuginfo@3.0.1-46.el9_0?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
                "product": {
                  "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
                  "product_id": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@3.0.1-46.el9_0?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-1:3.0.1-46.el9_0.i686",
                "product": {
                  "name": "openssl-libs-1:3.0.1-46.el9_0.i686",
                  "product_id": "openssl-libs-1:3.0.1-46.el9_0.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs@3.0.1-46.el9_0?arch=i686\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-devel-1:3.0.1-46.el9_0.x86_64",
                "product": {
                  "name": "openssl-devel-1:3.0.1-46.el9_0.x86_64",
                  "product_id": "openssl-devel-1:3.0.1-46.el9_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-devel@3.0.1-46.el9_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-perl-1:3.0.1-46.el9_0.x86_64",
                "product": {
                  "name": "openssl-perl-1:3.0.1-46.el9_0.x86_64",
                  "product_id": "openssl-perl-1:3.0.1-46.el9_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-perl@3.0.1-46.el9_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
                "product": {
                  "name": "openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
                  "product_id": "openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debugsource@3.0.1-46.el9_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
                "product": {
                  "name": "openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
                  "product_id": "openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debuginfo@3.0.1-46.el9_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
                "product": {
                  "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
                  "product_id": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@3.0.1-46.el9_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-1:3.0.1-46.el9_0.x86_64",
                "product": {
                  "name": "openssl-1:3.0.1-46.el9_0.x86_64",
                  "product_id": "openssl-1:3.0.1-46.el9_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl@3.0.1-46.el9_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-1:3.0.1-46.el9_0.x86_64",
                "product": {
                  "name": "openssl-libs-1:3.0.1-46.el9_0.x86_64",
                  "product_id": "openssl-libs-1:3.0.1-46.el9_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs@3.0.1-46.el9_0?arch=x86_64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-devel-1:3.0.1-46.el9_0.s390x",
                "product": {
                  "name": "openssl-devel-1:3.0.1-46.el9_0.s390x",
                  "product_id": "openssl-devel-1:3.0.1-46.el9_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-devel@3.0.1-46.el9_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-perl-1:3.0.1-46.el9_0.s390x",
                "product": {
                  "name": "openssl-perl-1:3.0.1-46.el9_0.s390x",
                  "product_id": "openssl-perl-1:3.0.1-46.el9_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-perl@3.0.1-46.el9_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debugsource-1:3.0.1-46.el9_0.s390x",
                "product": {
                  "name": "openssl-debugsource-1:3.0.1-46.el9_0.s390x",
                  "product_id": "openssl-debugsource-1:3.0.1-46.el9_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debugsource@3.0.1-46.el9_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
                "product": {
                  "name": "openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
                  "product_id": "openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debuginfo@3.0.1-46.el9_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
                "product": {
                  "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
                  "product_id": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@3.0.1-46.el9_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-1:3.0.1-46.el9_0.s390x",
                "product": {
                  "name": "openssl-1:3.0.1-46.el9_0.s390x",
                  "product_id": "openssl-1:3.0.1-46.el9_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl@3.0.1-46.el9_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-1:3.0.1-46.el9_0.s390x",
                "product": {
                  "name": "openssl-libs-1:3.0.1-46.el9_0.s390x",
                  "product_id": "openssl-libs-1:3.0.1-46.el9_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs@3.0.1-46.el9_0?arch=s390x\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-1:3.0.1-46.el9_0.src",
                "product": {
                  "name": "openssl-1:3.0.1-46.el9_0.src",
                  "product_id": "openssl-1:3.0.1-46.el9_0.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl@3.0.1-46.el9_0?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-46.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64"
        },
        "product_reference": "openssl-1:3.0.1-46.el9_0.aarch64",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-46.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le"
        },
        "product_reference": "openssl-1:3.0.1-46.el9_0.ppc64le",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-46.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x"
        },
        "product_reference": "openssl-1:3.0.1-46.el9_0.s390x",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-46.el9_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src"
        },
        "product_reference": "openssl-1:3.0.1-46.el9_0.src",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-46.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64"
        },
        "product_reference": "openssl-1:3.0.1-46.el9_0.x86_64",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-46.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-46.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-46.el9_0.i686",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-46.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-46.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-46.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-46.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-46.el9_0.i686",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-46.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-46.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-46.el9_0.s390x",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-46.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-46.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64"
        },
        "product_reference": "openssl-devel-1:3.0.1-46.el9_0.aarch64",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-46.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686"
        },
        "product_reference": "openssl-devel-1:3.0.1-46.el9_0.i686",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-46.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le"
        },
        "product_reference": "openssl-devel-1:3.0.1-46.el9_0.ppc64le",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-46.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x"
        },
        "product_reference": "openssl-devel-1:3.0.1-46.el9_0.s390x",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-46.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64"
        },
        "product_reference": "openssl-devel-1:3.0.1-46.el9_0.x86_64",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-46.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64"
        },
        "product_reference": "openssl-libs-1:3.0.1-46.el9_0.aarch64",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-46.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686"
        },
        "product_reference": "openssl-libs-1:3.0.1-46.el9_0.i686",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-46.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le"
        },
        "product_reference": "openssl-libs-1:3.0.1-46.el9_0.ppc64le",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-46.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x"
        },
        "product_reference": "openssl-libs-1:3.0.1-46.el9_0.s390x",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-46.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64"
        },
        "product_reference": "openssl-libs-1:3.0.1-46.el9_0.x86_64",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-46.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64"
        },
        "product_reference": "openssl-perl-1:3.0.1-46.el9_0.aarch64",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-46.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le"
        },
        "product_reference": "openssl-perl-1:3.0.1-46.el9_0.ppc64le",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-46.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x"
        },
        "product_reference": "openssl-perl-1:3.0.1-46.el9_0.s390x",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-46.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)",
          "product_id": "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
        },
        "product_reference": "openssl-perl-1:3.0.1-46.el9_0.x86_64",
        "relates_to_product_reference": "AppStream-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-46.el9_0.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64"
        },
        "product_reference": "openssl-1:3.0.1-46.el9_0.aarch64",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-46.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le"
        },
        "product_reference": "openssl-1:3.0.1-46.el9_0.ppc64le",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-46.el9_0.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x"
        },
        "product_reference": "openssl-1:3.0.1-46.el9_0.s390x",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-46.el9_0.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src"
        },
        "product_reference": "openssl-1:3.0.1-46.el9_0.src",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-46.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64"
        },
        "product_reference": "openssl-1:3.0.1-46.el9_0.x86_64",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-46.el9_0.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-46.el9_0.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-46.el9_0.i686",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-46.el9_0.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-46.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-46.el9_0.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-46.el9_0.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-46.el9_0.i686",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-46.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-46.el9_0.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-46.el9_0.s390x",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-46.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-46.el9_0.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64"
        },
        "product_reference": "openssl-devel-1:3.0.1-46.el9_0.aarch64",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-46.el9_0.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686"
        },
        "product_reference": "openssl-devel-1:3.0.1-46.el9_0.i686",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-46.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le"
        },
        "product_reference": "openssl-devel-1:3.0.1-46.el9_0.ppc64le",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-46.el9_0.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x"
        },
        "product_reference": "openssl-devel-1:3.0.1-46.el9_0.s390x",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-46.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64"
        },
        "product_reference": "openssl-devel-1:3.0.1-46.el9_0.x86_64",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-46.el9_0.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64"
        },
        "product_reference": "openssl-libs-1:3.0.1-46.el9_0.aarch64",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-46.el9_0.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686"
        },
        "product_reference": "openssl-libs-1:3.0.1-46.el9_0.i686",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-46.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le"
        },
        "product_reference": "openssl-libs-1:3.0.1-46.el9_0.ppc64le",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-46.el9_0.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x"
        },
        "product_reference": "openssl-libs-1:3.0.1-46.el9_0.s390x",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-46.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64"
        },
        "product_reference": "openssl-libs-1:3.0.1-46.el9_0.x86_64",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-46.el9_0.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64"
        },
        "product_reference": "openssl-perl-1:3.0.1-46.el9_0.aarch64",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-46.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le"
        },
        "product_reference": "openssl-perl-1:3.0.1-46.el9_0.ppc64le",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-46.el9_0.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x"
        },
        "product_reference": "openssl-perl-1:3.0.1-46.el9_0.s390x",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-46.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)",
          "product_id": "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
        },
        "product_reference": "openssl-perl-1:3.0.1-46.el9_0.x86_64",
        "relates_to_product_reference": "BaseOS-9.0.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4203",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164488"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Open SSL. A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification, and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: read buffer overflow in X.509 certificate verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 6, 7, and 8 ships OpenSSL 1.1.1 and 1.0.2 which do not contain the incorrect code, so those are not affected by this CVE. Similarly, the versions of `shim` as shipped with Red Hat Enterprise Linux 8 and 9 are not affected by this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-4203"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164488",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164488"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4203",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-4203"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4203",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4203"
        },
        {
          "category": "external",
          "summary": "https://www.openssl.org/news/secadv/20230207.txt",
          "url": "https://www.openssl.org/news/secadv/20230207.txt"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-03-14T13:57:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:1199"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: read buffer overflow in X.509 certificate verification"
    },
    {
      "cve": "CVE-2022-4304",
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164487"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A timing-based side channel exists in the OpenSSL RSA Decryption implementation, which could be sufficient to recover a ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption, an attacker would have to be able to send a very large number of trial messages for decryption. This issue affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP, and RSASVE.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: timing attack in RSA Decryption implementation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-4304"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164487",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164487"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4304",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-4304"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4304",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4304"
        },
        {
          "category": "external",
          "summary": "https://www.openssl.org/news/secadv/20230207.txt",
          "url": "https://www.openssl.org/news/secadv/20230207.txt"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-03-14T13:57:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:1199"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: timing attack in RSA Decryption implementation"
    },
    {
      "cve": "CVE-2022-4450",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164494"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A double-free vulnerability was found in OpenSSL\u0027s PEM_read_bio_ex function. The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the \"name\" (for example, \"CERTIFICATE\"), any header data, and the payload data. If the function succeeds, then the \"name_out,\" \"header,\" and \"data\" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. Constructing a PEM file that results in 0 bytes of payload data is possible. In this case, PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a freed buffer. A double-free will occur if the caller also frees this buffer. This will most likely lead to a crash. This could be exploited by an attacker who can supply malicious PEM files for parsing to achieve a denial of service attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: double free after calling PEM_read_bio_ex",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated as having a Moderate impact as it is less easily exploited and is only vulnerable in unlikely configurations. Additionally, the upstream advisory (linked in External References) also rates it as Moderate.\n\nThe versions of `shim` as shipped with Red Hat Enterprise Linux 8 and 9 are shipping OpenSSL 1.1.1 and 1.0.2, which do not contain the incorrect code, so those are not affected by this CVE.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-4450"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164494",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164494"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4450",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-4450"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4450",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4450"
        },
        {
          "category": "external",
          "summary": "https://www.openssl.org/news/secadv/20230207.txt",
          "url": "https://www.openssl.org/news/secadv/20230207.txt"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-03-14T13:57:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:1199"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: double free after calling PEM_read_bio_ex"
    },
    {
      "cve": "CVE-2023-0215",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164492"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free vulnerability was found in OpenSSL\u0027s BIO_new_NDEF function. The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally by OpenSSL to support the SMIME, CMS, and PKCS7 streaming capabilities, but it may also be called directly by end-user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions. For example, if a CMS recipient public key is invalid, the new filter BIO is freed, and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up, and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then calls BIO_pop() on the BIO, a use-after-free will occur, possibly resulting in a crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: use-after-free following BIO_new_NDEF",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability has been rated as having a moderate impact in alignment with upstream. See the security advisory linked in external references.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-0215"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164492",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164492"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0215",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-0215"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0215",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0215"
        },
        {
          "category": "external",
          "summary": "https://www.openssl.org/news/secadv/20230207.txt",
          "url": "https://www.openssl.org/news/secadv/20230207.txt"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-03-14T13:57:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:1199"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: use-after-free following BIO_new_NDEF"
    },
    {
      "cve": "CVE-2023-0216",
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164497"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. This may result in an application crash which could lead to a denial of service. The TLS implementation in OpenSSL does not call this function, however, third party applications might call these functions on untrusted data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: invalid pointer dereference in d2i_PKCS7 functions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 6, 7, and 8 ships OpenSSL 1.1.1 and 1.0.2 which do not contain the incorrect code, so those are not affected by this CVE. Similarly, the versions of `shim` as shipped with Red Hat Enterprise Linux 8 and 9 are not affected by this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-0216"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164497",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164497"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0216",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-0216"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0216",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0216"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-03-14T13:57:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:1199"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: invalid pointer dereference in d2i_PKCS7 functions"
    },
    {
      "cve": "CVE-2023-0217",
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164499"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function, most likely leading to an application crash. This function can be called on public keys supplied from untrusted sources, which could allow an attacker to cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: NULL dereference validating DSA public key",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 6, 7, and 8 ships OpenSSL 1.1.1 and 1.0.2 which do not contain the incorrect code, so those are not affected by this CVE. Similarly, the versions of `shim` as shipped with Red Hat Enterprise Linux 8 and 9 are not affected by this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-0217"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164499",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164499"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0217",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-0217"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0217",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0217"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-03-14T13:57:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:1199"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: NULL dereference validating DSA public key"
    },
    {
      "cve": "CVE-2023-0286",
      "cwe": {
        "id": "CWE-704",
        "name": "Incorrect Type Conversion or Cast"
      },
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164440"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A type confusion vulnerability was found in OpenSSL when OpenSSL X.400 addresses processing inside an X.509 GeneralName. When CRL checking is enabled (for example, the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or cause a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, of which neither needs a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. In this case, this vulnerability is likely only to affect applications that have implemented their own functionality for retrieving CRLs over a network.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: X.400 address type confusion in X.509 GeneralName",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "For shim in Red Hat Enterprise Linux 8 \u0026 9, is not affected as shim doesn\u0027t support any CRL processing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-0286"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164440",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164440"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0286",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0286",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0286"
        },
        {
          "category": "external",
          "summary": "https://www.openssl.org/news/secadv/20230207.txt",
          "url": "https://www.openssl.org/news/secadv/20230207.txt"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-03-14T13:57:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:1199"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl: X.400 address type confusion in X.509 GeneralName"
    },
    {
      "cve": "CVE-2023-0401",
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164500"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A NULL pointer vulnerability was found in OpenSSL, which can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available, the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API, most likely leading to a crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: NULL dereference during PKCS7 data verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 6, 7, and 8 ships OpenSSL 1.1.1 and 1.0.2 which do not contain the incorrect code, so those are not affected by this CVE. Similarly, the versions of `shim` as shipped with Red Hat Enterprise Linux 8 and 9 are not affected by this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
          "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
          "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-0401"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164500",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164500"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0401",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-0401"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0401",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0401"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-03-14T13:57:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:1199"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "AppStream-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "AppStream-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.src",
            "BaseOS-9.0.0.Z.EUS:openssl-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-debugsource-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-devel-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.i686",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-libs-debuginfo-1:3.0.1-46.el9_0.x86_64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.aarch64",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.ppc64le",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.s390x",
            "BaseOS-9.0.0.Z.EUS:openssl-perl-1:3.0.1-46.el9_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: NULL dereference during PKCS7 data verification"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for openssl is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\n[Updated 20 March 2023]\nPreviously, this erratum was marked as having a security impact of Moderate. This was incorrect; the security impact of this erratum has been changed to Important, to correctly reflect the highest impact rating of CVE fixes included in this release. No changes have been made to packages.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)\n\n* openssl: read buffer overflow in X.509 certificate verification (CVE-2022-4203)\n\n* openssl: timing attack in RSA Decryption implementation (CVE-2022-4304)\n\n* openssl: double free after calling PEM_read_bio_ex (CVE-2022-4450)\n\n* openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215)\n\n* openssl: invalid pointer dereference in d2i_PKCS7 functions (CVE-2023-0216)\n\n* openssl: NULL dereference validating DSA public key (CVE-2023-0217)\n\n* openssl: NULL dereference during PKCS7 data verification (CVE-2023-0401)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* HMAC generation should reject key lengths \u003c 112 bits or provide an indicator in FIPS mode (BZ#2144000)\n\n* In FIPS mode, openssl should set a minimum length for passwords in PBKDF2 (BZ#2144003)\n\n* stunnel consumes high amount of memory when pestered with TCP connections without a TLS handshake (BZ#2144008)\n\n* In FIPS mode, openssl should reject SHAKE as digest for RSA-OAEP or provide an indicator (BZ#2144010)\n\n* In FIPS mode, openssl should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator (BZ#2144012)\n\n* In FIPS mode, openssl should reject RSA signatures with X9.31 padding, or provide an indicator (BZ#2144015)\n\n* In FIPS mode, openssl should reject SHA-224, SHA-384, SHA-512-224, and SHA-512-256 as hashes for hash-based DRBGs, or provide an indicator after 2023-05-16 (BZ#2144017)\n\n* In FIPS mode, openssl should reject KDF input and output key lengths \u003c 112 bits or provide an indicator (BZ#2144019)\n\n* In FIPS mode, openssl should reject RSA keys \u003c 2048 bits when using EVP_PKEY_decapsulate, or provide an indicator (BZ#2145170)\n\n* RHEL9.1 Nightly[0912] - error:03000093:digital envelope routines::command not supported when git clone is run with configured ibmca engine backed by libica.so.4 (OpenSSL 3.0) (BZ#2149010)\n\n* OpenSSL FIPS checksum code needs update (BZ#2158412)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:0946",
        "url": "https://access.redhat.com/errata/RHSA-2023:0946"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2144000",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144000"
      },
      {
        "category": "external",
        "summary": "2144003",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144003"
      },
      {
        "category": "external",
        "summary": "2144006",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144006"
      },
      {
        "category": "external",
        "summary": "2144008",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144008"
      },
      {
        "category": "external",
        "summary": "2144010",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144010"
      },
      {
        "category": "external",
        "summary": "2144012",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144012"
      },
      {
        "category": "external",
        "summary": "2144015",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144015"
      },
      {
        "category": "external",
        "summary": "2144017",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144017"
      },
      {
        "category": "external",
        "summary": "2144019",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144019"
      },
      {
        "category": "external",
        "summary": "2145170",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145170"
      },
      {
        "category": "external",
        "summary": "2158412",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158412"
      },
      {
        "category": "external",
        "summary": "2164440",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164440"
      },
      {
        "category": "external",
        "summary": "2164487",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164487"
      },
      {
        "category": "external",
        "summary": "2164488",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164488"
      },
      {
        "category": "external",
        "summary": "2164492",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164492"
      },
      {
        "category": "external",
        "summary": "2164494",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164494"
      },
      {
        "category": "external",
        "summary": "2164497",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164497"
      },
      {
        "category": "external",
        "summary": "2164499",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164499"
      },
      {
        "category": "external",
        "summary": "2164500",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164500"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0946.json"
      }
    ],
    "title": "Red Hat Security Advisory: openssl security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-25T08:49:13+00:00",
      "generator": {
        "date": "2024-11-25T08:49:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2023:0946",
      "initial_release_date": "2023-02-28T08:22:08+00:00",
      "revision_history": [
        {
          "date": "2023-02-28T08:22:08+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-03-21T11:29:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-25T08:49:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.1.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 9)",
                  "product_id": "BaseOS-9.1.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:9::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-1:3.0.1-47.el9_1.src",
                "product": {
                  "name": "openssl-1:3.0.1-47.el9_1.src",
                  "product_id": "openssl-1:3.0.1-47.el9_1.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl@3.0.1-47.el9_1?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-1:3.0.1-47.el9_1.aarch64",
                "product": {
                  "name": "openssl-1:3.0.1-47.el9_1.aarch64",
                  "product_id": "openssl-1:3.0.1-47.el9_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl@3.0.1-47.el9_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-1:3.0.1-47.el9_1.aarch64",
                "product": {
                  "name": "openssl-libs-1:3.0.1-47.el9_1.aarch64",
                  "product_id": "openssl-libs-1:3.0.1-47.el9_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs@3.0.1-47.el9_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
                "product": {
                  "name": "openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
                  "product_id": "openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debugsource@3.0.1-47.el9_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
                "product": {
                  "name": "openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
                  "product_id": "openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debuginfo@3.0.1-47.el9_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
                "product": {
                  "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
                  "product_id": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@3.0.1-47.el9_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-devel-1:3.0.1-47.el9_1.aarch64",
                "product": {
                  "name": "openssl-devel-1:3.0.1-47.el9_1.aarch64",
                  "product_id": "openssl-devel-1:3.0.1-47.el9_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-devel@3.0.1-47.el9_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-perl-1:3.0.1-47.el9_1.aarch64",
                "product": {
                  "name": "openssl-perl-1:3.0.1-47.el9_1.aarch64",
                  "product_id": "openssl-perl-1:3.0.1-47.el9_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-perl@3.0.1-47.el9_1?arch=aarch64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-1:3.0.1-47.el9_1.ppc64le",
                "product": {
                  "name": "openssl-1:3.0.1-47.el9_1.ppc64le",
                  "product_id": "openssl-1:3.0.1-47.el9_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl@3.0.1-47.el9_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-1:3.0.1-47.el9_1.ppc64le",
                "product": {
                  "name": "openssl-libs-1:3.0.1-47.el9_1.ppc64le",
                  "product_id": "openssl-libs-1:3.0.1-47.el9_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs@3.0.1-47.el9_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
                "product": {
                  "name": "openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
                  "product_id": "openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debugsource@3.0.1-47.el9_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
                "product": {
                  "name": "openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
                  "product_id": "openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debuginfo@3.0.1-47.el9_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
                "product": {
                  "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
                  "product_id": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@3.0.1-47.el9_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-devel-1:3.0.1-47.el9_1.ppc64le",
                "product": {
                  "name": "openssl-devel-1:3.0.1-47.el9_1.ppc64le",
                  "product_id": "openssl-devel-1:3.0.1-47.el9_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-devel@3.0.1-47.el9_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-perl-1:3.0.1-47.el9_1.ppc64le",
                "product": {
                  "name": "openssl-perl-1:3.0.1-47.el9_1.ppc64le",
                  "product_id": "openssl-perl-1:3.0.1-47.el9_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-perl@3.0.1-47.el9_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-1:3.0.1-47.el9_1.x86_64",
                "product": {
                  "name": "openssl-1:3.0.1-47.el9_1.x86_64",
                  "product_id": "openssl-1:3.0.1-47.el9_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl@3.0.1-47.el9_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-1:3.0.1-47.el9_1.x86_64",
                "product": {
                  "name": "openssl-libs-1:3.0.1-47.el9_1.x86_64",
                  "product_id": "openssl-libs-1:3.0.1-47.el9_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs@3.0.1-47.el9_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
                "product": {
                  "name": "openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
                  "product_id": "openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debugsource@3.0.1-47.el9_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
                "product": {
                  "name": "openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
                  "product_id": "openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debuginfo@3.0.1-47.el9_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
                "product": {
                  "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
                  "product_id": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@3.0.1-47.el9_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-devel-1:3.0.1-47.el9_1.x86_64",
                "product": {
                  "name": "openssl-devel-1:3.0.1-47.el9_1.x86_64",
                  "product_id": "openssl-devel-1:3.0.1-47.el9_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-devel@3.0.1-47.el9_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-perl-1:3.0.1-47.el9_1.x86_64",
                "product": {
                  "name": "openssl-perl-1:3.0.1-47.el9_1.x86_64",
                  "product_id": "openssl-perl-1:3.0.1-47.el9_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-perl@3.0.1-47.el9_1?arch=x86_64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-libs-1:3.0.1-47.el9_1.i686",
                "product": {
                  "name": "openssl-libs-1:3.0.1-47.el9_1.i686",
                  "product_id": "openssl-libs-1:3.0.1-47.el9_1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs@3.0.1-47.el9_1?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debugsource-1:3.0.1-47.el9_1.i686",
                "product": {
                  "name": "openssl-debugsource-1:3.0.1-47.el9_1.i686",
                  "product_id": "openssl-debugsource-1:3.0.1-47.el9_1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debugsource@3.0.1-47.el9_1?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debuginfo-1:3.0.1-47.el9_1.i686",
                "product": {
                  "name": "openssl-debuginfo-1:3.0.1-47.el9_1.i686",
                  "product_id": "openssl-debuginfo-1:3.0.1-47.el9_1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debuginfo@3.0.1-47.el9_1?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
                "product": {
                  "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
                  "product_id": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@3.0.1-47.el9_1?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-devel-1:3.0.1-47.el9_1.i686",
                "product": {
                  "name": "openssl-devel-1:3.0.1-47.el9_1.i686",
                  "product_id": "openssl-devel-1:3.0.1-47.el9_1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-devel@3.0.1-47.el9_1?arch=i686\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-1:3.0.1-47.el9_1.s390x",
                "product": {
                  "name": "openssl-1:3.0.1-47.el9_1.s390x",
                  "product_id": "openssl-1:3.0.1-47.el9_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl@3.0.1-47.el9_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-1:3.0.1-47.el9_1.s390x",
                "product": {
                  "name": "openssl-libs-1:3.0.1-47.el9_1.s390x",
                  "product_id": "openssl-libs-1:3.0.1-47.el9_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs@3.0.1-47.el9_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debugsource-1:3.0.1-47.el9_1.s390x",
                "product": {
                  "name": "openssl-debugsource-1:3.0.1-47.el9_1.s390x",
                  "product_id": "openssl-debugsource-1:3.0.1-47.el9_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debugsource@3.0.1-47.el9_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
                "product": {
                  "name": "openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
                  "product_id": "openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-debuginfo@3.0.1-47.el9_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
                "product": {
                  "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
                  "product_id": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@3.0.1-47.el9_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-devel-1:3.0.1-47.el9_1.s390x",
                "product": {
                  "name": "openssl-devel-1:3.0.1-47.el9_1.s390x",
                  "product_id": "openssl-devel-1:3.0.1-47.el9_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-devel@3.0.1-47.el9_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-perl-1:3.0.1-47.el9_1.s390x",
                "product": {
                  "name": "openssl-perl-1:3.0.1-47.el9_1.s390x",
                  "product_id": "openssl-perl-1:3.0.1-47.el9_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl-perl@3.0.1-47.el9_1?arch=s390x\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-47.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64"
        },
        "product_reference": "openssl-1:3.0.1-47.el9_1.aarch64",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-47.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le"
        },
        "product_reference": "openssl-1:3.0.1-47.el9_1.ppc64le",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-47.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x"
        },
        "product_reference": "openssl-1:3.0.1-47.el9_1.s390x",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-47.el9_1.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src"
        },
        "product_reference": "openssl-1:3.0.1-47.el9_1.src",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-47.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64"
        },
        "product_reference": "openssl-1:3.0.1-47.el9_1.x86_64",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-47.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-47.el9_1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-47.el9_1.i686",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-47.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-47.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-47.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-47.el9_1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-47.el9_1.i686",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-47.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-47.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-47.el9_1.s390x",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-47.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-47.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64"
        },
        "product_reference": "openssl-devel-1:3.0.1-47.el9_1.aarch64",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-47.el9_1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686"
        },
        "product_reference": "openssl-devel-1:3.0.1-47.el9_1.i686",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-47.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le"
        },
        "product_reference": "openssl-devel-1:3.0.1-47.el9_1.ppc64le",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-47.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x"
        },
        "product_reference": "openssl-devel-1:3.0.1-47.el9_1.s390x",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-47.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64"
        },
        "product_reference": "openssl-devel-1:3.0.1-47.el9_1.x86_64",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-47.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64"
        },
        "product_reference": "openssl-libs-1:3.0.1-47.el9_1.aarch64",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-47.el9_1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686"
        },
        "product_reference": "openssl-libs-1:3.0.1-47.el9_1.i686",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-47.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le"
        },
        "product_reference": "openssl-libs-1:3.0.1-47.el9_1.ppc64le",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-47.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x"
        },
        "product_reference": "openssl-libs-1:3.0.1-47.el9_1.s390x",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-47.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64"
        },
        "product_reference": "openssl-libs-1:3.0.1-47.el9_1.x86_64",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-47.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64"
        },
        "product_reference": "openssl-perl-1:3.0.1-47.el9_1.aarch64",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-47.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le"
        },
        "product_reference": "openssl-perl-1:3.0.1-47.el9_1.ppc64le",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-47.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x"
        },
        "product_reference": "openssl-perl-1:3.0.1-47.el9_1.s390x",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-47.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
        },
        "product_reference": "openssl-perl-1:3.0.1-47.el9_1.x86_64",
        "relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-47.el9_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64"
        },
        "product_reference": "openssl-1:3.0.1-47.el9_1.aarch64",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-47.el9_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le"
        },
        "product_reference": "openssl-1:3.0.1-47.el9_1.ppc64le",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-47.el9_1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x"
        },
        "product_reference": "openssl-1:3.0.1-47.el9_1.s390x",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-47.el9_1.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src"
        },
        "product_reference": "openssl-1:3.0.1-47.el9_1.src",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1:3.0.1-47.el9_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64"
        },
        "product_reference": "openssl-1:3.0.1-47.el9_1.x86_64",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-47.el9_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-47.el9_1.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-47.el9_1.i686",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-47.el9_1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debuginfo-1:3.0.1-47.el9_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64"
        },
        "product_reference": "openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-47.el9_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-47.el9_1.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-47.el9_1.i686",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-47.el9_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-47.el9_1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-47.el9_1.s390x",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-debugsource-1:3.0.1-47.el9_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64"
        },
        "product_reference": "openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-47.el9_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64"
        },
        "product_reference": "openssl-devel-1:3.0.1-47.el9_1.aarch64",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-47.el9_1.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686"
        },
        "product_reference": "openssl-devel-1:3.0.1-47.el9_1.i686",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-47.el9_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le"
        },
        "product_reference": "openssl-devel-1:3.0.1-47.el9_1.ppc64le",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-47.el9_1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x"
        },
        "product_reference": "openssl-devel-1:3.0.1-47.el9_1.s390x",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-devel-1:3.0.1-47.el9_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64"
        },
        "product_reference": "openssl-devel-1:3.0.1-47.el9_1.x86_64",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-47.el9_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64"
        },
        "product_reference": "openssl-libs-1:3.0.1-47.el9_1.aarch64",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-47.el9_1.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686"
        },
        "product_reference": "openssl-libs-1:3.0.1-47.el9_1.i686",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-47.el9_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le"
        },
        "product_reference": "openssl-libs-1:3.0.1-47.el9_1.ppc64le",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-47.el9_1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x"
        },
        "product_reference": "openssl-libs-1:3.0.1-47.el9_1.s390x",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-1:3.0.1-47.el9_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64"
        },
        "product_reference": "openssl-libs-1:3.0.1-47.el9_1.x86_64",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64"
        },
        "product_reference": "openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-47.el9_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64"
        },
        "product_reference": "openssl-perl-1:3.0.1-47.el9_1.aarch64",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-47.el9_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le"
        },
        "product_reference": "openssl-perl-1:3.0.1-47.el9_1.ppc64le",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-47.el9_1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x"
        },
        "product_reference": "openssl-perl-1:3.0.1-47.el9_1.s390x",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-perl-1:3.0.1-47.el9_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
        },
        "product_reference": "openssl-perl-1:3.0.1-47.el9_1.x86_64",
        "relates_to_product_reference": "BaseOS-9.1.0.Z.MAIN"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4203",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164488"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Open SSL. A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification, and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: read buffer overflow in X.509 certificate verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 6, 7, and 8 ships OpenSSL 1.1.1 and 1.0.2 which do not contain the incorrect code, so those are not affected by this CVE. Similarly, the versions of `shim` as shipped with Red Hat Enterprise Linux 8 and 9 are not affected by this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-4203"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164488",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164488"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4203",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-4203"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4203",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4203"
        },
        {
          "category": "external",
          "summary": "https://www.openssl.org/news/secadv/20230207.txt",
          "url": "https://www.openssl.org/news/secadv/20230207.txt"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-02-28T08:22:08+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0946"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: read buffer overflow in X.509 certificate verification"
    },
    {
      "cve": "CVE-2022-4304",
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164487"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A timing-based side channel exists in the OpenSSL RSA Decryption implementation, which could be sufficient to recover a ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption, an attacker would have to be able to send a very large number of trial messages for decryption. This issue affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP, and RSASVE.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: timing attack in RSA Decryption implementation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-4304"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164487",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164487"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4304",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-4304"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4304",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4304"
        },
        {
          "category": "external",
          "summary": "https://www.openssl.org/news/secadv/20230207.txt",
          "url": "https://www.openssl.org/news/secadv/20230207.txt"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-02-28T08:22:08+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0946"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: timing attack in RSA Decryption implementation"
    },
    {
      "cve": "CVE-2022-4450",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164494"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A double-free vulnerability was found in OpenSSL\u0027s PEM_read_bio_ex function. The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the \"name\" (for example, \"CERTIFICATE\"), any header data, and the payload data. If the function succeeds, then the \"name_out,\" \"header,\" and \"data\" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. Constructing a PEM file that results in 0 bytes of payload data is possible. In this case, PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a freed buffer. A double-free will occur if the caller also frees this buffer. This will most likely lead to a crash. This could be exploited by an attacker who can supply malicious PEM files for parsing to achieve a denial of service attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: double free after calling PEM_read_bio_ex",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated as having a Moderate impact as it is less easily exploited and is only vulnerable in unlikely configurations. Additionally, the upstream advisory (linked in External References) also rates it as Moderate.\n\nThe versions of `shim` as shipped with Red Hat Enterprise Linux 8 and 9 are shipping OpenSSL 1.1.1 and 1.0.2, which do not contain the incorrect code, so those are not affected by this CVE.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-4450"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164494",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164494"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4450",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-4450"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4450",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4450"
        },
        {
          "category": "external",
          "summary": "https://www.openssl.org/news/secadv/20230207.txt",
          "url": "https://www.openssl.org/news/secadv/20230207.txt"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-02-28T08:22:08+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0946"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: double free after calling PEM_read_bio_ex"
    },
    {
      "cve": "CVE-2023-0215",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164492"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free vulnerability was found in OpenSSL\u0027s BIO_new_NDEF function. The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally by OpenSSL to support the SMIME, CMS, and PKCS7 streaming capabilities, but it may also be called directly by end-user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions. For example, if a CMS recipient public key is invalid, the new filter BIO is freed, and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up, and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then calls BIO_pop() on the BIO, a use-after-free will occur, possibly resulting in a crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: use-after-free following BIO_new_NDEF",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability has been rated as having a moderate impact in alignment with upstream. See the security advisory linked in external references.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-0215"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164492",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164492"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0215",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-0215"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0215",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0215"
        },
        {
          "category": "external",
          "summary": "https://www.openssl.org/news/secadv/20230207.txt",
          "url": "https://www.openssl.org/news/secadv/20230207.txt"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-02-28T08:22:08+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0946"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: use-after-free following BIO_new_NDEF"
    },
    {
      "cve": "CVE-2023-0216",
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164497"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. This may result in an application crash which could lead to a denial of service. The TLS implementation in OpenSSL does not call this function, however, third party applications might call these functions on untrusted data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: invalid pointer dereference in d2i_PKCS7 functions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 6, 7, and 8 ships OpenSSL 1.1.1 and 1.0.2 which do not contain the incorrect code, so those are not affected by this CVE. Similarly, the versions of `shim` as shipped with Red Hat Enterprise Linux 8 and 9 are not affected by this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-0216"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164497",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164497"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0216",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-0216"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0216",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0216"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-02-28T08:22:08+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0946"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: invalid pointer dereference in d2i_PKCS7 functions"
    },
    {
      "cve": "CVE-2023-0217",
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164499"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function, most likely leading to an application crash. This function can be called on public keys supplied from untrusted sources, which could allow an attacker to cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: NULL dereference validating DSA public key",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 6, 7, and 8 ships OpenSSL 1.1.1 and 1.0.2 which do not contain the incorrect code, so those are not affected by this CVE. Similarly, the versions of `shim` as shipped with Red Hat Enterprise Linux 8 and 9 are not affected by this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-0217"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164499",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164499"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0217",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-0217"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0217",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0217"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-02-28T08:22:08+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0946"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: NULL dereference validating DSA public key"
    },
    {
      "cve": "CVE-2023-0286",
      "cwe": {
        "id": "CWE-704",
        "name": "Incorrect Type Conversion or Cast"
      },
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164440"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A type confusion vulnerability was found in OpenSSL when OpenSSL X.400 addresses processing inside an X.509 GeneralName. When CRL checking is enabled (for example, the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or cause a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, of which neither needs a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. In this case, this vulnerability is likely only to affect applications that have implemented their own functionality for retrieving CRLs over a network.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: X.400 address type confusion in X.509 GeneralName",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "For shim in Red Hat Enterprise Linux 8 \u0026 9, is not affected as shim doesn\u0027t support any CRL processing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-0286"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164440",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164440"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0286",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0286",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0286"
        },
        {
          "category": "external",
          "summary": "https://www.openssl.org/news/secadv/20230207.txt",
          "url": "https://www.openssl.org/news/secadv/20230207.txt"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-02-28T08:22:08+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0946"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl: X.400 address type confusion in X.509 GeneralName"
    },
    {
      "cve": "CVE-2023-0401",
      "discovery_date": "2023-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2164500"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A NULL pointer vulnerability was found in OpenSSL, which can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available, the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API, most likely leading to a crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: NULL dereference during PKCS7 data verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 6, 7, and 8 ships OpenSSL 1.1.1 and 1.0.2 which do not contain the incorrect code, so those are not affected by this CVE. Similarly, the versions of `shim` as shipped with Red Hat Enterprise Linux 8 and 9 are not affected by this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
          "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
          "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-0401"
        },
        {
          "category": "external",
          "summary": "RHBZ#2164500",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164500"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0401",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-0401"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0401",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0401"
        }
      ],
      "release_date": "2023-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-02-28T08:22:08+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
          "product_ids": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0946"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "AppStream-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "AppStream-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.src",
            "BaseOS-9.1.0.Z.MAIN:openssl-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-debugsource-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-devel-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.i686",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-libs-debuginfo-1:3.0.1-47.el9_1.x86_64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.aarch64",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.ppc64le",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.s390x",
            "BaseOS-9.1.0.Z.MAIN:openssl-perl-1:3.0.1-47.el9_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: NULL dereference during PKCS7 data verification"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "openssl-src"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "300.0.0"
            },
            {
              "fixed": "300.0.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-0401"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-08T22:21:22Z",
    "nvd_published_at": "2023-02-08T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "A `NULL` pointer can be dereferenced when signatures are being verified on PKCS7 `signed` or `signedAndEnveloped` data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider.\n\nPKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.",
  "id": "GHSA-vrh7-x64v-7vxq",
  "modified": "2023-02-21T19:48:07Z",
  "published": "2023-02-08T22:21:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0401"
    },
    {
      "type": "WEB",
      "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=d3b6dfd70db844c4499bec6ad6601623a565e674"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/alexcrichton/openssl-src-rs"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2023-0013.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202402-08"
    },
    {
      "type": "WEB",
      "url": "https://www.openssl.org/news/secadv/20230207.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "openssl-src contains `NULL` dereference during PKCS7 data verification"
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "FreeFlow-Druckserver ist eine Druckserveranwendung f\u00fcr Xerox-Produktionsdrucker, die Flexibilit\u00e4t, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-1424 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1424.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-1424 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1424"
      },
      {
        "category": "external",
        "summary": "Xerox Security Bulletin vom 2023-06-12",
        "url": "https://securitydocs.business.xerox.com/wp-content/uploads/2023/06/Xerox-Security-Bulletin-XRX23-009-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v9.pdf"
      }
    ],
    "source_lang": "en-US",
    "title": "Xerox FreeFlow Print Server f\u00fcr Solaris: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-06-12T22:00:00.000+00:00",
      "generator": {
        "date": "2024-02-15T17:30:41.322+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2023-1424",
      "initial_release_date": "2023-06-12T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-06-12T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Xerox FreeFlow Print Server v9 for Solaris",
            "product": {
              "name": "Xerox FreeFlow Print Server v9 for Solaris",
              "product_id": "T028053",
              "product_identification_helper": {
                "cpe": "cpe:/a:xerox:freeflow_print_server:v9_for_solaris"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Xerox"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-28708",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-28708"
    },
    {
      "cve": "CVE-2023-28176",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-28176"
    },
    {
      "cve": "CVE-2023-28164",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-28164"
    },
    {
      "cve": "CVE-2023-28163",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-28163"
    },
    {
      "cve": "CVE-2023-28162",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-28162"
    },
    {
      "cve": "CVE-2023-27522",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-27522"
    },
    {
      "cve": "CVE-2023-25752",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25752"
    },
    {
      "cve": "CVE-2023-25751",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25751"
    },
    {
      "cve": "CVE-2023-25746",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25746"
    },
    {
      "cve": "CVE-2023-25744",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25744"
    },
    {
      "cve": "CVE-2023-25743",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25743"
    },
    {
      "cve": "CVE-2023-25742",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25742"
    },
    {
      "cve": "CVE-2023-25739",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25739"
    },
    {
      "cve": "CVE-2023-25738",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25738"
    },
    {
      "cve": "CVE-2023-25737",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25737"
    },
    {
      "cve": "CVE-2023-25735",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25735"
    },
    {
      "cve": "CVE-2023-25734",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25734"
    },
    {
      "cve": "CVE-2023-25732",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25732"
    },
    {
      "cve": "CVE-2023-25730",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25730"
    },
    {
      "cve": "CVE-2023-25729",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25729"
    },
    {
      "cve": "CVE-2023-25728",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25728"
    },
    {
      "cve": "CVE-2023-25690",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25690"
    },
    {
      "cve": "CVE-2023-24998",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-24998"
    },
    {
      "cve": "CVE-2023-24807",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-24807"
    },
    {
      "cve": "CVE-2023-24580",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-24580"
    },
    {
      "cve": "CVE-2023-23969",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23969"
    },
    {
      "cve": "CVE-2023-23946",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23946"
    },
    {
      "cve": "CVE-2023-23936",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23936"
    },
    {
      "cve": "CVE-2023-23920",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23920"
    },
    {
      "cve": "CVE-2023-23919",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23919"
    },
    {
      "cve": "CVE-2023-23918",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23918"
    },
    {
      "cve": "CVE-2023-23605",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23605"
    },
    {
      "cve": "CVE-2023-23603",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23603"
    },
    {
      "cve": "CVE-2023-23602",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23602"
    },
    {
      "cve": "CVE-2023-23601",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23601"
    },
    {
      "cve": "CVE-2023-23599",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23599"
    },
    {
      "cve": "CVE-2023-23598",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23598"
    },
    {
      "cve": "CVE-2023-22809",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-22809"
    },
    {
      "cve": "CVE-2023-22490",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-22490"
    },
    {
      "cve": "CVE-2023-22003",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-22003"
    },
    {
      "cve": "CVE-2023-21985",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-21985"
    },
    {
      "cve": "CVE-2023-21984",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-21984"
    },
    {
      "cve": "CVE-2023-21928",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-21928"
    },
    {
      "cve": "CVE-2023-21896",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-21896"
    },
    {
      "cve": "CVE-2023-21843",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-21843"
    },
    {
      "cve": "CVE-2023-21840",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-21840"
    },
    {
      "cve": "CVE-2023-21830",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-21830"
    },
    {
      "cve": "CVE-2023-0804",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0804"
    },
    {
      "cve": "CVE-2023-0803",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0803"
    },
    {
      "cve": "CVE-2023-0802",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0802"
    },
    {
      "cve": "CVE-2023-0801",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0801"
    },
    {
      "cve": "CVE-2023-0800",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0800"
    },
    {
      "cve": "CVE-2023-0799",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0799"
    },
    {
      "cve": "CVE-2023-0798",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0798"
    },
    {
      "cve": "CVE-2023-0797",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0797"
    },
    {
      "cve": "CVE-2023-0796",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0796"
    },
    {
      "cve": "CVE-2023-0795",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0795"
    },
    {
      "cve": "CVE-2023-0767",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0767"
    },
    {
      "cve": "CVE-2023-0662",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0662"
    },
    {
      "cve": "CVE-2023-0616",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0616"
    },
    {
      "cve": "CVE-2023-0568",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0568"
    },
    {
      "cve": "CVE-2023-0567",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0567"
    },
    {
      "cve": "CVE-2023-0430",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0430"
    },
    {
      "cve": "CVE-2023-0417",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0417"
    },
    {
      "cve": "CVE-2023-0416",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0416"
    },
    {
      "cve": "CVE-2023-0415",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0415"
    },
    {
      "cve": "CVE-2023-0414",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0414"
    },
    {
      "cve": "CVE-2023-0413",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0413"
    },
    {
      "cve": "CVE-2023-0412",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0412"
    },
    {
      "cve": "CVE-2023-0411",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0411"
    },
    {
      "cve": "CVE-2023-0401",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0401"
    },
    {
      "cve": "CVE-2023-0286",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0286"
    },
    {
      "cve": "CVE-2023-0217",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0217"
    },
    {
      "cve": "CVE-2023-0216",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0216"
    },
    {
      "cve": "CVE-2023-0215",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0215"
    },
    {
      "cve": "CVE-2022-48281",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-48281"
    },
    {
      "cve": "CVE-2022-46877",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46877"
    },
    {
      "cve": "CVE-2022-46874",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46874"
    },
    {
      "cve": "CVE-2022-46871",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46871"
    },
    {
      "cve": "CVE-2022-46344",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46344"
    },
    {
      "cve": "CVE-2022-46343",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46343"
    },
    {
      "cve": "CVE-2022-46342",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46342"
    },
    {
      "cve": "CVE-2022-46341",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46341"
    },
    {
      "cve": "CVE-2022-46340",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46340"
    },
    {
      "cve": "CVE-2022-45939",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-45939"
    },
    {
      "cve": "CVE-2022-45199",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-45199"
    },
    {
      "cve": "CVE-2022-45143",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-45143"
    },
    {
      "cve": "CVE-2022-4450",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-4450"
    },
    {
      "cve": "CVE-2022-4345",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-4345"
    },
    {
      "cve": "CVE-2022-4304",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-4304"
    },
    {
      "cve": "CVE-2022-42919",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-42919"
    },
    {
      "cve": "CVE-2022-42916",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-42916"
    },
    {
      "cve": "CVE-2022-42915",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-42915"
    },
    {
      "cve": "CVE-2022-42898",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-42898"
    },
    {
      "cve": "CVE-2022-4283",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-4283"
    },
    {
      "cve": "CVE-2022-4203",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-4203"
    },
    {
      "cve": "CVE-2022-42012",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-42012"
    },
    {
      "cve": "CVE-2022-42011",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-42011"
    },
    {
      "cve": "CVE-2022-42010",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-42010"
    },
    {
      "cve": "CVE-2022-41903",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-41903"
    },
    {
      "cve": "CVE-2022-41716",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-41716"
    },
    {
      "cve": "CVE-2022-41715",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-41715"
    },
    {
      "cve": "CVE-2022-40898",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-40898"
    },
    {
      "cve": "CVE-2022-40304",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-40304"
    },
    {
      "cve": "CVE-2022-40303",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-40303"
    },
    {
      "cve": "CVE-2022-39253",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-39253"
    },
    {
      "cve": "CVE-2022-3924",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3924"
    },
    {
      "cve": "CVE-2022-38784",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-38784"
    },
    {
      "cve": "CVE-2022-38171",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-38171"
    },
    {
      "cve": "CVE-2022-37436",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-37436"
    },
    {
      "cve": "CVE-2022-3736",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3736"
    },
    {
      "cve": "CVE-2022-3705",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3705"
    },
    {
      "cve": "CVE-2022-36760",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-36760"
    },
    {
      "cve": "CVE-2022-36227",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-36227"
    },
    {
      "cve": "CVE-2022-36114",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-36114"
    },
    {
      "cve": "CVE-2022-36113",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-36113"
    },
    {
      "cve": "CVE-2022-35260",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-35260"
    },
    {
      "cve": "CVE-2022-35252",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-35252"
    },
    {
      "cve": "CVE-2022-3515",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3515"
    },
    {
      "cve": "CVE-2022-3352",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3352"
    },
    {
      "cve": "CVE-2022-3324",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3324"
    },
    {
      "cve": "CVE-2022-3297",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3297"
    },
    {
      "cve": "CVE-2022-3296",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3296"
    },
    {
      "cve": "CVE-2022-3278",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3278"
    },
    {
      "cve": "CVE-2022-3256",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3256"
    },
    {
      "cve": "CVE-2022-3235",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3235"
    },
    {
      "cve": "CVE-2022-3234",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3234"
    },
    {
      "cve": "CVE-2022-32221",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32221"
    },
    {
      "cve": "CVE-2022-32208",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32208"
    },
    {
      "cve": "CVE-2022-32207",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32207"
    },
    {
      "cve": "CVE-2022-32206",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32206"
    },
    {
      "cve": "CVE-2022-32205",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32205"
    },
    {
      "cve": "CVE-2022-32190",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32190"
    },
    {
      "cve": "CVE-2022-32189",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32189"
    },
    {
      "cve": "CVE-2022-32148",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32148"
    },
    {
      "cve": "CVE-2022-3153",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3153"
    },
    {
      "cve": "CVE-2022-3134",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3134"
    },
    {
      "cve": "CVE-2022-3099",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3099"
    },
    {
      "cve": "CVE-2022-3094",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3094"
    },
    {
      "cve": "CVE-2022-30635",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30635"
    },
    {
      "cve": "CVE-2022-30634",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30634"
    },
    {
      "cve": "CVE-2022-30633",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30633"
    },
    {
      "cve": "CVE-2022-30632",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30632"
    },
    {
      "cve": "CVE-2022-30631",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30631"
    },
    {
      "cve": "CVE-2022-30630",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30630"
    },
    {
      "cve": "CVE-2022-30629",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30629"
    },
    {
      "cve": "CVE-2022-30580",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30580"
    },
    {
      "cve": "CVE-2022-3037",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3037"
    },
    {
      "cve": "CVE-2022-3016",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3016"
    },
    {
      "cve": "CVE-2022-29804",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-29804"
    },
    {
      "cve": "CVE-2022-2980",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2980"
    },
    {
      "cve": "CVE-2022-29526",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-29526"
    },
    {
      "cve": "CVE-2022-2946",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2946"
    },
    {
      "cve": "CVE-2022-2929",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2929"
    },
    {
      "cve": "CVE-2022-2928",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2928"
    },
    {
      "cve": "CVE-2022-2923",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2923"
    },
    {
      "cve": "CVE-2022-2889",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2889"
    },
    {
      "cve": "CVE-2022-2880",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2880"
    },
    {
      "cve": "CVE-2022-2879",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2879"
    },
    {
      "cve": "CVE-2022-2874",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2874"
    },
    {
      "cve": "CVE-2022-2862",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2862"
    },
    {
      "cve": "CVE-2022-2849",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2849"
    },
    {
      "cve": "CVE-2022-2845",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2845"
    },
    {
      "cve": "CVE-2022-28331",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-28331"
    },
    {
      "cve": "CVE-2022-28327",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-28327"
    },
    {
      "cve": "CVE-2022-2819",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2819"
    },
    {
      "cve": "CVE-2022-2817",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2817"
    },
    {
      "cve": "CVE-2022-2816",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2816"
    },
    {
      "cve": "CVE-2022-28131",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-28131"
    },
    {
      "cve": "CVE-2022-27778",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-27778"
    },
    {
      "cve": "CVE-2022-27664",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-27664"
    },
    {
      "cve": "CVE-2022-27536",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-27536"
    },
    {
      "cve": "CVE-2022-27337",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-27337"
    },
    {
      "cve": "CVE-2022-25255",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-25255"
    },
    {
      "cve": "CVE-2022-25147",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-25147"
    },
    {
      "cve": "CVE-2022-24963",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-24963"
    },
    {
      "cve": "CVE-2022-24675",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-24675"
    },
    {
      "cve": "CVE-2022-23521",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-23521"
    },
    {
      "cve": "CVE-2022-2309",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2309"
    },
    {
      "cve": "CVE-2022-21515",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-21515"
    },
    {
      "cve": "CVE-2022-21349",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-21349"
    },
    {
      "cve": "CVE-2022-21291",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-21291"
    },
    {
      "cve": "CVE-2022-1962",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-1962"
    },
    {
      "cve": "CVE-2022-1705",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-1705"
    },
    {
      "cve": "CVE-2022-1292",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-1292"
    },
    {
      "cve": "CVE-2022-1122",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-1122"
    },
    {
      "cve": "CVE-2022-0718",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-0718"
    },
    {
      "cve": "CVE-2021-37750",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2021-37750"
    },
    {
      "cve": "CVE-2021-37519",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2021-37519"
    },
    {
      "cve": "CVE-2021-35940",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2021-35940"
    },
    {
      "cve": "CVE-2021-30860",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2021-30860"
    },
    {
      "cve": "CVE-2021-29338",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2021-29338"
    },
    {
      "cve": "CVE-2018-25032",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2018-25032"
    },
    {
      "cve": "CVE-2017-12613",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2017-12613"
    },
    {
      "cve": "CVE-2006-20001",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2006-20001"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "FreeFlow-Druckserver ist eine Druckserveranwendung f\u00fcr Xerox-Produktionsdrucker, die Flexibilit\u00e4t, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-1424 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1424.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-1424 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1424"
      },
      {
        "category": "external",
        "summary": "Xerox Security Bulletin vom 2023-06-12",
        "url": "https://securitydocs.business.xerox.com/wp-content/uploads/2023/06/Xerox-Security-Bulletin-XRX23-009-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v9.pdf"
      }
    ],
    "source_lang": "en-US",
    "title": "Xerox FreeFlow Print Server f\u00fcr Solaris: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-06-12T22:00:00.000+00:00",
      "generator": {
        "date": "2024-02-15T17:30:41.322+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2023-1424",
      "initial_release_date": "2023-06-12T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-06-12T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Xerox FreeFlow Print Server v9 for Solaris",
            "product": {
              "name": "Xerox FreeFlow Print Server v9 for Solaris",
              "product_id": "T028053",
              "product_identification_helper": {
                "cpe": "cpe:/a:xerox:freeflow_print_server:v9_for_solaris"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Xerox"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-28708",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-28708"
    },
    {
      "cve": "CVE-2023-28176",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-28176"
    },
    {
      "cve": "CVE-2023-28164",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-28164"
    },
    {
      "cve": "CVE-2023-28163",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-28163"
    },
    {
      "cve": "CVE-2023-28162",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-28162"
    },
    {
      "cve": "CVE-2023-27522",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-27522"
    },
    {
      "cve": "CVE-2023-25752",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25752"
    },
    {
      "cve": "CVE-2023-25751",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25751"
    },
    {
      "cve": "CVE-2023-25746",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25746"
    },
    {
      "cve": "CVE-2023-25744",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25744"
    },
    {
      "cve": "CVE-2023-25743",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25743"
    },
    {
      "cve": "CVE-2023-25742",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25742"
    },
    {
      "cve": "CVE-2023-25739",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25739"
    },
    {
      "cve": "CVE-2023-25738",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25738"
    },
    {
      "cve": "CVE-2023-25737",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25737"
    },
    {
      "cve": "CVE-2023-25735",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25735"
    },
    {
      "cve": "CVE-2023-25734",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25734"
    },
    {
      "cve": "CVE-2023-25732",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25732"
    },
    {
      "cve": "CVE-2023-25730",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25730"
    },
    {
      "cve": "CVE-2023-25729",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25729"
    },
    {
      "cve": "CVE-2023-25728",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25728"
    },
    {
      "cve": "CVE-2023-25690",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-25690"
    },
    {
      "cve": "CVE-2023-24998",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-24998"
    },
    {
      "cve": "CVE-2023-24807",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-24807"
    },
    {
      "cve": "CVE-2023-24580",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-24580"
    },
    {
      "cve": "CVE-2023-23969",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23969"
    },
    {
      "cve": "CVE-2023-23946",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23946"
    },
    {
      "cve": "CVE-2023-23936",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23936"
    },
    {
      "cve": "CVE-2023-23920",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23920"
    },
    {
      "cve": "CVE-2023-23919",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23919"
    },
    {
      "cve": "CVE-2023-23918",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23918"
    },
    {
      "cve": "CVE-2023-23605",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23605"
    },
    {
      "cve": "CVE-2023-23603",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23603"
    },
    {
      "cve": "CVE-2023-23602",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23602"
    },
    {
      "cve": "CVE-2023-23601",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23601"
    },
    {
      "cve": "CVE-2023-23599",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23599"
    },
    {
      "cve": "CVE-2023-23598",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-23598"
    },
    {
      "cve": "CVE-2023-22809",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-22809"
    },
    {
      "cve": "CVE-2023-22490",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-22490"
    },
    {
      "cve": "CVE-2023-22003",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-22003"
    },
    {
      "cve": "CVE-2023-21985",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-21985"
    },
    {
      "cve": "CVE-2023-21984",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-21984"
    },
    {
      "cve": "CVE-2023-21928",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-21928"
    },
    {
      "cve": "CVE-2023-21896",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-21896"
    },
    {
      "cve": "CVE-2023-21843",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-21843"
    },
    {
      "cve": "CVE-2023-21840",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-21840"
    },
    {
      "cve": "CVE-2023-21830",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-21830"
    },
    {
      "cve": "CVE-2023-0804",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0804"
    },
    {
      "cve": "CVE-2023-0803",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0803"
    },
    {
      "cve": "CVE-2023-0802",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0802"
    },
    {
      "cve": "CVE-2023-0801",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0801"
    },
    {
      "cve": "CVE-2023-0800",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0800"
    },
    {
      "cve": "CVE-2023-0799",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0799"
    },
    {
      "cve": "CVE-2023-0798",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0798"
    },
    {
      "cve": "CVE-2023-0797",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0797"
    },
    {
      "cve": "CVE-2023-0796",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0796"
    },
    {
      "cve": "CVE-2023-0795",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0795"
    },
    {
      "cve": "CVE-2023-0767",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0767"
    },
    {
      "cve": "CVE-2023-0662",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0662"
    },
    {
      "cve": "CVE-2023-0616",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0616"
    },
    {
      "cve": "CVE-2023-0568",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0568"
    },
    {
      "cve": "CVE-2023-0567",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0567"
    },
    {
      "cve": "CVE-2023-0430",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0430"
    },
    {
      "cve": "CVE-2023-0417",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0417"
    },
    {
      "cve": "CVE-2023-0416",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0416"
    },
    {
      "cve": "CVE-2023-0415",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0415"
    },
    {
      "cve": "CVE-2023-0414",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0414"
    },
    {
      "cve": "CVE-2023-0413",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0413"
    },
    {
      "cve": "CVE-2023-0412",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0412"
    },
    {
      "cve": "CVE-2023-0411",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0411"
    },
    {
      "cve": "CVE-2023-0401",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0401"
    },
    {
      "cve": "CVE-2023-0286",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0286"
    },
    {
      "cve": "CVE-2023-0217",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0217"
    },
    {
      "cve": "CVE-2023-0216",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0216"
    },
    {
      "cve": "CVE-2023-0215",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2023-0215"
    },
    {
      "cve": "CVE-2022-48281",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-48281"
    },
    {
      "cve": "CVE-2022-46877",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46877"
    },
    {
      "cve": "CVE-2022-46874",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46874"
    },
    {
      "cve": "CVE-2022-46871",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46871"
    },
    {
      "cve": "CVE-2022-46344",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46344"
    },
    {
      "cve": "CVE-2022-46343",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46343"
    },
    {
      "cve": "CVE-2022-46342",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46342"
    },
    {
      "cve": "CVE-2022-46341",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46341"
    },
    {
      "cve": "CVE-2022-46340",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-46340"
    },
    {
      "cve": "CVE-2022-45939",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-45939"
    },
    {
      "cve": "CVE-2022-45199",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-45199"
    },
    {
      "cve": "CVE-2022-45143",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-45143"
    },
    {
      "cve": "CVE-2022-4450",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-4450"
    },
    {
      "cve": "CVE-2022-4345",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-4345"
    },
    {
      "cve": "CVE-2022-4304",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-4304"
    },
    {
      "cve": "CVE-2022-42919",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-42919"
    },
    {
      "cve": "CVE-2022-42916",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-42916"
    },
    {
      "cve": "CVE-2022-42915",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-42915"
    },
    {
      "cve": "CVE-2022-42898",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-42898"
    },
    {
      "cve": "CVE-2022-4283",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-4283"
    },
    {
      "cve": "CVE-2022-4203",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-4203"
    },
    {
      "cve": "CVE-2022-42012",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-42012"
    },
    {
      "cve": "CVE-2022-42011",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-42011"
    },
    {
      "cve": "CVE-2022-42010",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-42010"
    },
    {
      "cve": "CVE-2022-41903",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-41903"
    },
    {
      "cve": "CVE-2022-41716",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-41716"
    },
    {
      "cve": "CVE-2022-41715",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-41715"
    },
    {
      "cve": "CVE-2022-40898",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-40898"
    },
    {
      "cve": "CVE-2022-40304",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-40304"
    },
    {
      "cve": "CVE-2022-40303",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-40303"
    },
    {
      "cve": "CVE-2022-39253",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-39253"
    },
    {
      "cve": "CVE-2022-3924",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3924"
    },
    {
      "cve": "CVE-2022-38784",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-38784"
    },
    {
      "cve": "CVE-2022-38171",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-38171"
    },
    {
      "cve": "CVE-2022-37436",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-37436"
    },
    {
      "cve": "CVE-2022-3736",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3736"
    },
    {
      "cve": "CVE-2022-3705",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3705"
    },
    {
      "cve": "CVE-2022-36760",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-36760"
    },
    {
      "cve": "CVE-2022-36227",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-36227"
    },
    {
      "cve": "CVE-2022-36114",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-36114"
    },
    {
      "cve": "CVE-2022-36113",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-36113"
    },
    {
      "cve": "CVE-2022-35260",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-35260"
    },
    {
      "cve": "CVE-2022-35252",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-35252"
    },
    {
      "cve": "CVE-2022-3515",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3515"
    },
    {
      "cve": "CVE-2022-3352",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3352"
    },
    {
      "cve": "CVE-2022-3324",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3324"
    },
    {
      "cve": "CVE-2022-3297",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3297"
    },
    {
      "cve": "CVE-2022-3296",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3296"
    },
    {
      "cve": "CVE-2022-3278",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3278"
    },
    {
      "cve": "CVE-2022-3256",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3256"
    },
    {
      "cve": "CVE-2022-3235",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3235"
    },
    {
      "cve": "CVE-2022-3234",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3234"
    },
    {
      "cve": "CVE-2022-32221",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32221"
    },
    {
      "cve": "CVE-2022-32208",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32208"
    },
    {
      "cve": "CVE-2022-32207",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32207"
    },
    {
      "cve": "CVE-2022-32206",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32206"
    },
    {
      "cve": "CVE-2022-32205",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32205"
    },
    {
      "cve": "CVE-2022-32190",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32190"
    },
    {
      "cve": "CVE-2022-32189",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32189"
    },
    {
      "cve": "CVE-2022-32148",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-32148"
    },
    {
      "cve": "CVE-2022-3153",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3153"
    },
    {
      "cve": "CVE-2022-3134",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3134"
    },
    {
      "cve": "CVE-2022-3099",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3099"
    },
    {
      "cve": "CVE-2022-3094",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3094"
    },
    {
      "cve": "CVE-2022-30635",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30635"
    },
    {
      "cve": "CVE-2022-30634",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30634"
    },
    {
      "cve": "CVE-2022-30633",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30633"
    },
    {
      "cve": "CVE-2022-30632",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30632"
    },
    {
      "cve": "CVE-2022-30631",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30631"
    },
    {
      "cve": "CVE-2022-30630",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30630"
    },
    {
      "cve": "CVE-2022-30629",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30629"
    },
    {
      "cve": "CVE-2022-30580",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-30580"
    },
    {
      "cve": "CVE-2022-3037",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3037"
    },
    {
      "cve": "CVE-2022-3016",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-3016"
    },
    {
      "cve": "CVE-2022-29804",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-29804"
    },
    {
      "cve": "CVE-2022-2980",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2980"
    },
    {
      "cve": "CVE-2022-29526",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-29526"
    },
    {
      "cve": "CVE-2022-2946",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2946"
    },
    {
      "cve": "CVE-2022-2929",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2929"
    },
    {
      "cve": "CVE-2022-2928",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2928"
    },
    {
      "cve": "CVE-2022-2923",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2923"
    },
    {
      "cve": "CVE-2022-2889",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2889"
    },
    {
      "cve": "CVE-2022-2880",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2880"
    },
    {
      "cve": "CVE-2022-2879",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2879"
    },
    {
      "cve": "CVE-2022-2874",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2874"
    },
    {
      "cve": "CVE-2022-2862",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2862"
    },
    {
      "cve": "CVE-2022-2849",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2849"
    },
    {
      "cve": "CVE-2022-2845",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2845"
    },
    {
      "cve": "CVE-2022-28331",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-28331"
    },
    {
      "cve": "CVE-2022-28327",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-28327"
    },
    {
      "cve": "CVE-2022-2819",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2819"
    },
    {
      "cve": "CVE-2022-2817",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2817"
    },
    {
      "cve": "CVE-2022-2816",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2816"
    },
    {
      "cve": "CVE-2022-28131",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-28131"
    },
    {
      "cve": "CVE-2022-27778",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-27778"
    },
    {
      "cve": "CVE-2022-27664",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-27664"
    },
    {
      "cve": "CVE-2022-27536",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-27536"
    },
    {
      "cve": "CVE-2022-27337",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-27337"
    },
    {
      "cve": "CVE-2022-25255",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-25255"
    },
    {
      "cve": "CVE-2022-25147",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-25147"
    },
    {
      "cve": "CVE-2022-24963",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-24963"
    },
    {
      "cve": "CVE-2022-24675",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-24675"
    },
    {
      "cve": "CVE-2022-23521",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-23521"
    },
    {
      "cve": "CVE-2022-2309",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-2309"
    },
    {
      "cve": "CVE-2022-21515",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-21515"
    },
    {
      "cve": "CVE-2022-21349",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-21349"
    },
    {
      "cve": "CVE-2022-21291",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-21291"
    },
    {
      "cve": "CVE-2022-1962",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-1962"
    },
    {
      "cve": "CVE-2022-1705",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-1705"
    },
    {
      "cve": "CVE-2022-1292",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-1292"
    },
    {
      "cve": "CVE-2022-1122",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-1122"
    },
    {
      "cve": "CVE-2022-0718",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2022-0718"
    },
    {
      "cve": "CVE-2021-37750",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2021-37750"
    },
    {
      "cve": "CVE-2021-37519",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2021-37519"
    },
    {
      "cve": "CVE-2021-35940",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2021-35940"
    },
    {
      "cve": "CVE-2021-30860",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2021-30860"
    },
    {
      "cve": "CVE-2021-29338",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2021-29338"
    },
    {
      "cve": "CVE-2018-25032",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2018-25032"
    },
    {
      "cve": "CVE-2017-12613",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2017-12613"
    },
    {
      "cve": "CVE-2006-20001",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen im Zusammenhang mit bekannten Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028053"
        ]
      },
      "release_date": "2023-06-12T22:00:00Z",
      "title": "CVE-2006-20001"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "OpenSSL ist eine im Quelltext frei verf\u00fcgbare Bibliothek, die Secure Sockets Layer (SSL) und Transport Layer Security (TLS) implementiert.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren, Informationen offenzulegen oder Chiffretext \u00fcber ein Netzwerk wiederherzustellen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-0304 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0304.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-0304 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0304"
      },
      {
        "category": "external",
        "summary": "OpenSSL Security Advisory vom 2023-02-07",
        "url": "https://www.openssl.org/news/secadv/20230207.txt"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2023-1935 vom 2023-02-08",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-1935.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2023-1683 vom 2023-02-08",
        "url": "https://alas.aws.amazon.com/ALAS-2023-1683.html"
      },
      {
        "category": "external",
        "summary": "Aruba Product Security Advisory",
        "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-001.txt"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2023-1934 vom 2023-02-08",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-1934.html"
      },
      {
        "category": "external",
        "summary": "NetApp Security Advisory NTAP-20230214-0011 vom 2023-02-14",
        "url": "https://security.netapp.com/advisory/ntap-20230214-0011/"
      },
      {
        "category": "external",
        "summary": "FreeBSD Security Advisory FREEBSD-SA-23:03.OPENSSL vom 2023-02-16",
        "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:03.openssl.asc"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-3325 vom 2023-02-20",
        "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00019.html"
      },
      {
        "category": "external",
        "summary": "McAfee Security Bulletin SB10395 vom 2023-02-22",
        "url": "https://kcm.trellix.com/corporate/index?page=content\u0026id=SB10395\u0026viewlocale=en_US\u0026platinum_status=false\u0026locale=en_US"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:0482-1 vom 2023-02-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013880.html"
      },
      {
        "category": "external",
        "summary": "LANCOM Sicherheitshinweise",
        "url": "https://www.lancom-systems.de/service-support/soforthilfe/allgemeine-sicherheitshinweise/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:0581-1 vom 2023-02-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013933.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:0946 vom 2023-02-28",
        "url": "https://access.redhat.com/errata/RHSA-2023:0946"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-0946 vom 2023-02-28",
        "url": "http://linux.oracle.com/errata/ELSA-2023-0946.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6959033 vom 2023-03-01",
        "url": "https://www.ibm.com/support/pages/node/6959033"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:0584-1 vom 2023-03-01",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-March/013952.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-12152 vom 2023-03-01",
        "url": "https://linux.oracle.com/errata/ELSA-2023-12152.html"
      },
      {
        "category": "external",
        "summary": "SonicWall Product Notifications",
        "url": "https://www.sonicwall.com/support/product-notification/sma-100-series-openssl-library-update-in-10-2-1-7/230228123000903/"
      },
      {
        "category": "external",
        "summary": "Tenable Security Advisory TNS-2023-09 vom 2023-03-02",
        "url": "https://www.tenable.com/security/tns-2023-09"
      },
      {
        "category": "external",
        "summary": "Tenable Security Advisory TNS-2023-10 vom 2023-03-07",
        "url": "https://www.tenable.com/security/tns-2023-10"
      },
      {
        "category": "external",
        "summary": "Tenable Security Advisory TNS-2023-11 vom 2023-03-07",
        "url": "https://www.tenable.com/security/tns-2023-11"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6960563 vom 2023-03-07",
        "url": "https://www.ibm.com/support/pages/node/6960563"
      },
      {
        "category": "external",
        "summary": "### vom 2023-03-07",
        "url": "https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6960511 vom 2023-03-07",
        "url": "https://www.ibm.com/support/pages/node/6960511"
      },
      {
        "category": "external",
        "summary": "Tenable Security Advisory TNS-2023-12 vom 2023-03-09",
        "url": "https://www.tenable.com/security/tns-2023-12"
      },
      {
        "category": "external",
        "summary": "Tenable Security Advisory TNS-2023-13 vom 2023-03-09",
        "url": "https://www.tenable.com/security/tns-2023-13"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:0684-1 vom 2023-03-09",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-March/014009.html"
      },
      {
        "category": "external",
        "summary": "Siemens Security Bulletin by Siemens ProductCERT",
        "url": "https://cert-portal.siemens.com/productcert/html/ssb-439005.html"
      },
      {
        "category": "external",
        "summary": "Meinberg Security Advisory MBGSA-2023.02 vom 2023-03-14",
        "url": "https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2023-02-meinberg-lantime-firmware-v7-06-012.htm"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:1199 vom 2023-03-14",
        "url": "https://access.redhat.com/errata/RHSA-2023:1199"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6957718 vom 2023-03-16",
        "url": "https://www.ibm.com/support/pages/node/6957718"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6963634 vom 2023-03-16",
        "url": "https://www.cybersecurity-help.cz/vdb/SB2023031618"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6963784 vom 2023-03-20",
        "url": "https://www.ibm.com/support/pages/node/6963784"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6963786 vom 2023-03-20",
        "url": "https://www.cybersecurity-help.cz/vdb/SB2023032014"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:1335 vom 2023-03-20",
        "url": "https://access.redhat.com/errata/RHSA-2023:1335"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-1335 vom 2023-03-20",
        "url": "http://linux.oracle.com/errata/ELSA-2023-1335.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6964854 vom 2023-03-21",
        "url": "https://aix.software.ibm.com/aix/efixes/security/openssl_advisory38.asc"
      },
      {
        "category": "external",
        "summary": "Dell Knowledge Base Article",
        "url": "https://www.dell.com/support/kbdoc/en-us/000221474/dsa-2024-059-security-update-for-dell-networker-multiple-components-vulnerabilities"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:1405 vom 2023-03-22",
        "url": "https://access.redhat.com/errata/RHSA-2023:1405"
      },
      {
        "category": "external",
        "summary": "CentOS Security Advisory CESA-2023:1335 vom 2023-03-22",
        "url": "https://lists.centos.org/pipermail/centos-announce/2023-March/086392.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-12205 vom 2023-03-22",
        "url": "https://linux.oracle.com/errata/ELSA-2023-12205.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-1405 vom 2023-03-23",
        "url": "http://linux.oracle.com/errata/ELSA-2023-1405.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-12213 vom 2023-03-28",
        "url": "https://linux.oracle.com/errata/ELSA-2023-12213.html"
      },
      {
        "category": "external",
        "summary": "QNAP Security Advisory QSA-23-15 vom 2023-03-29",
        "url": "https://www.qnap.com/de-de/security-advisory/QSA-23-15"
      },
      {
        "category": "external",
        "summary": "F5 K000132941 vom 2023-04-06",
        "url": "https://my.f5.com/manage/s/article/K000132941"
      },
      {
        "category": "external",
        "summary": "F5 K000132943 vom 2023-04-06",
        "url": "https://my.f5.com/manage/s/article/K000132943"
      },
      {
        "category": "external",
        "summary": "F5 K000132946 vom 2023-04-06",
        "url": "https://my.f5.com/manage/s/article/K000132946"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2023-113 vom 2023-12-13",
        "url": "https://www.dell.com/support/kbdoc/000211759/dsa-2023-="
      },
      {
        "category": "external",
        "summary": "Meinberg Security Advisory MBGSA-2023.02 vom 2023-03-23",
        "url": "https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2023-02-lantime-firmware-v7-06-013.htm"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6986323 vom 2023-04-26",
        "url": "https://www.ibm.com/support/pages/node/6986323"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:2022 vom 2023-04-26",
        "url": "https://access.redhat.com/errata/RHSA-2023:2022"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6987461 vom 2023-05-01",
        "url": "https://www.ibm.com/support/pages/node/6987461"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:2098 vom 2023-05-03",
        "url": "https://access.redhat.com/errata/RHSA-2023:2098"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-12326 vom 2023-05-04",
        "url": "https://linux.oracle.com/errata/ELSA-2023-12326.html"
      },
      {
        "category": "external",
        "summary": "Tenable Security Advisory TNS-2023-19 vom 2023-05-10",
        "url": "https://www.tenable.com/security/tns-2023-19"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:2165 vom 2023-05-09",
        "url": "https://access.redhat.com/errata/RHSA-2023:2165"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6985831 vom 2023-05-10",
        "url": "https://www.ibm.com/support/pages/node/6985831"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:2932 vom 2023-05-16",
        "url": "https://access.redhat.com/errata/RHSA-2023:2932"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6983555 vom 2023-05-17",
        "url": "https://www.ibm.com/support/pages/node/6983555"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-2932 vom 2023-05-24",
        "url": "https://linux.oracle.com/errata/ELSA-2023-2932.html"
      },
      {
        "category": "external",
        "summary": "Hitachi Cybersecurity Advisory vom 2023-04-25",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-02"
      },
      {
        "category": "external",
        "summary": "HP Security Bulletin",
        "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04445en_us"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6998707 vom 2023-05-26",
        "url": "https://www.ibm.com/support/pages/node/6998707"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2023-134 vom 2023-05-26",
        "url": "https://www.dell.com/support/kbdoc/de-de/000214129/dsa-2023-134-security-update-for-dell-poweredge-server-for-multiple-openssl-vulnerabilities"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3408 vom 2023-06-01",
        "url": "https://access.redhat.com/errata/RHSA-2023:3408"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2633-1 vom 2024-02-27",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-February/018032.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2634-1 vom 2024-02-27",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-February/018031.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3354 vom 2023-06-05",
        "url": "https://access.redhat.com/errata/RHSA-2023:3354"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3355 vom 2023-06-05",
        "url": "https://access.redhat.com/errata/RHSA-2023:3355"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3420 vom 2023-06-05",
        "url": "https://access.redhat.com/errata/RHSA-2023:3420"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3421 vom 2023-06-05",
        "url": "https://access.redhat.com/errata/RHSA-2023:3421"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3455 vom 2023-06-06",
        "url": "https://access.redhat.com/errata/RHSA-2023:3455"
      },
      {
        "category": "external",
        "summary": "XEROX Security Advisory XRX23-008 vom 2023-06-06",
        "url": "https://security.business.xerox.com/wp-content/uploads/2023/06/Xerox-Security-Bulletin-XRX23-008-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v7.pdf"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:0305-2 vom 2023-06-06",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-June/015094.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3542 vom 2023-06-14",
        "url": "https://access.redhat.com/errata/RHSA-2023:3542"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7005589 vom 2023-06-21",
        "url": "https://www.ibm.com/support/pages/node/7005589"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3612 vom 2023-06-23",
        "url": "https://access.redhat.com/errata/RHSA-2023:3614"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:29171-1 vom 2023-06-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-June/015287.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2623-1 vom 2023-06-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-June/015285.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2622-1 vom 2023-06-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-June/015286.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2624-1 vom 2023-06-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-June/015284.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3615 vom 2023-06-22",
        "url": "https://access.redhat.com/errata/RHSA-2023:3615"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2648-1 vom 2023-06-27",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-June/015323.html"
      },
      {
        "category": "external",
        "summary": "Hitachi Energy CYBERSECURITY ADVISORY vom 2023-06-27",
        "url": "https://library.e.abb.com/public/4fffbb03a11143c0b70e57acbd1c9f66/8DBD000157-VU-2023-004-OpenSSL_Relion_670_650_Rev1.pdf"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7007815 vom 2023-06-28",
        "url": "https://www.ibm.com/support/pages/node/7007815"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7009735 vom 2023-07-05",
        "url": "https://www.ibm.com/support/pages/node/7009735"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7010099 vom 2023-07-06",
        "url": "https://www.ibm.com/support/pages/node/7010099"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7006449 vom 2023-07-07",
        "url": "https://www.ibm.com/support/pages/node/7006449"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4128 vom 2023-07-18",
        "url": "https://access.redhat.com/errata/RHSA-2023:4128"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4124 vom 2023-07-18",
        "url": "https://access.redhat.com/errata/RHSA-2023:4124"
      },
      {
        "category": "external",
        "summary": "Gentoo Linux Security Advisory GLSA-202402-08 vom 2024-02-04",
        "url": "https://security.gentoo.org/glsa/202402-08"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4091 vom 2023-07-20",
        "url": "https://access.redhat.com/errata/RHSA-2023:4091"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4252 vom 2023-07-25",
        "url": "https://access.redhat.com/errata/RHSA-2023:4252"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:3096-1 vom 2023-08-01",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-August/015724.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:3179-1 vom 2023-08-03",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-August/015773.html"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory SSA-264815 vom 2023-08-08",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-264815.html"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory SSA-264814 vom 2023-08-08",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-264814.html"
      },
      {
        "category": "external",
        "summary": "ORACLE OVMSA-2023-0013 vom 2023-08-17",
        "url": "https://oss.oracle.com/pipermail/oraclevm-errata/2023-August/001082.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7108821 vom 2024-01-17",
        "url": "https://www.ibm.com/support/pages/node/7108821"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4982 vom 2023-09-05",
        "url": "https://access.redhat.com/errata/RHSA-2023:4982"
      },
      {
        "category": "external",
        "summary": "HPE Security Bulletin",
        "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbgn04530en_us"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:5209 vom 2023-09-19",
        "url": "https://access.redhat.com/errata/RHSA-2023:5209"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2023-135 vom 2023-09-26",
        "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-135/index.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALASOPENSSL-SNAPSAFE-2023-002 vom 2023-09-27",
        "url": "https://alas.aws.amazon.com/AL2/ALASOPENSSL-SNAPSAFE-2023-002.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7035370 vom 2023-10-03",
        "url": "https://www.ibm.com/support/pages/node/7035370"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7041682 vom 2023-10-04",
        "url": "https://www.ibm.com/support/pages/node/7041682"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-6564-1 vom 2024-01-03",
        "url": "https://ubuntu.com/security/notices/USN-6564-1"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7063708 vom 2023-10-31",
        "url": "https://www.ibm.com/support/pages/node/7063708"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-13027 vom 2023-12-07",
        "url": "https://linux.oracle.com/errata/ELSA-2023-13027.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-13024 vom 2023-12-07",
        "url": "https://linux.oracle.com/errata/ELSA-2023-13024.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-32790 vom 2023-12-07",
        "url": "https://linux.oracle.com/errata/ELSA-2023-32790.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-13025 vom 2023-12-07",
        "url": "https://linux.oracle.com/errata/ELSA-2023-13025.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-13026 vom 2023-12-07",
        "url": "https://linux.oracle.com/errata/ELSA-2023-13026.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-32791 vom 2023-12-07",
        "url": "https://linux.oracle.com/errata/ELSA-2023-32791.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2024-2502 vom 2024-03-19",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2024-2502.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7145367 vom 2024-03-27",
        "url": "https://www.ibm.com/support/pages/node/7145367"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-20865 vom 2024-04-25",
        "url": "https://linux.oracle.com/errata/ELSA-2024-20865.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-12343 vom 2024-04-25",
        "url": "https://linux.oracle.com/errata/ELSA-2024-12343.html"
      },
      {
        "category": "external",
        "summary": "SolarWinds Platform 2024.2 release notes vom 2024-06-04",
        "url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-2_release_notes.htm"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-12408 vom 2024-06-05",
        "url": "https://linux.oracle.com/errata/ELSA-2024-12408.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-23120 vom 2024-06-04",
        "url": "https://linux.oracle.com/errata/ELSA-2024-23120.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-12409 vom 2024-06-04",
        "url": "https://linux.oracle.com/errata/ELSA-2024-12409.html"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2023-207 vom 2024-06-13",
        "url": "https://www.dell.com/support/kbdoc/de-de/000216897/dsa-2023-207-security-update-for-dell-poweredge-t40-mini-tower-server-openssl-vulnerabilities"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2024-250 vom 2024-06-27",
        "url": "https://www.dell.com/support/kbdoc/de-de/000226426/dsa-2024-250-security-update-for-dell-avamar-dell-integrated-data-protection-appliance-idpa-security-update-for-multiple-vulnerabilities"
      },
      {
        "category": "external",
        "summary": "ICS Advisory vom 2024-07-23",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-205-02"
      }
    ],
    "source_lang": "en-US",
    "title": "OpenSSL: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-07-23T22:00:00.000+00:00",
      "generator": {
        "date": "2024-07-24T09:11:01.861+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2023-0304",
      "initial_release_date": "2023-02-07T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-02-07T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-02-08T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Amazon und Aruba aufgenommen"
        },
        {
          "date": "2023-02-09T23:00:00.000+00:00",
          "number": "3",
          "summary": "Referenz(en) aufgenommen: FEDORA-2023-A5564C0A3F, FEDORA-2023-57F33242BC"
        },
        {
          "date": "2023-02-14T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von NetApp aufgenommen"
        },
        {
          "date": "2023-02-16T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von FreeBSD aufgenommen"
        },
        {
          "date": "2023-02-19T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2023-02-22T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von McAfee aufgenommen"
        },
        {
          "date": "2023-02-23T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-02-27T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2023-02-28T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von SUSE, Red Hat und Oracle Linux aufgenommen"
        },
        {
          "date": "2023-03-01T23:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2023-03-02T23:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Tenable aufgenommen"
        },
        {
          "date": "2023-03-07T23:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Tenable, IBM und IBM-APAR aufgenommen"
        },
        {
          "date": "2023-03-09T23:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Tenable und SUSE aufgenommen"
        },
        {
          "date": "2023-03-13T23:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Siemens aufgenommen"
        },
        {
          "date": "2023-03-14T23:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-03-15T23:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-03-19T23:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-03-20T23:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Red Hat und Oracle Linux aufgenommen"
        },
        {
          "date": "2023-03-21T23:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-03-22T23:00:00.000+00:00",
          "number": "21",
          "summary": "Neue Updates von Red Hat, CentOS und Oracle Linux aufgenommen"
        },
        {
          "date": "2023-03-28T22:00:00.000+00:00",
          "number": "22",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2023-03-29T22:00:00.000+00:00",
          "number": "23",
          "summary": "Neue Updates von QNAP aufgenommen"
        },
        {
          "date": "2023-04-10T22:00:00.000+00:00",
          "number": "24",
          "summary": "Neue Informationen von F5 aufgenommen"
        },
        {
          "date": "2023-04-24T22:00:00.000+00:00",
          "number": "25",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2023-04-26T22:00:00.000+00:00",
          "number": "26",
          "summary": "Neue Updates von IBM und Red Hat aufgenommen"
        },
        {
          "date": "2023-05-01T22:00:00.000+00:00",
          "number": "27",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-05-03T22:00:00.000+00:00",
          "number": "28",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-05-04T22:00:00.000+00:00",
          "number": "29",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2023-05-09T22:00:00.000+00:00",
          "number": "30",
          "summary": "Neue Updates von Tenable und Red Hat aufgenommen"
        },
        {
          "date": "2023-05-10T22:00:00.000+00:00",
          "number": "31",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-05-16T22:00:00.000+00:00",
          "number": "32",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-05-23T22:00:00.000+00:00",
          "number": "33",
          "summary": "Neue Updates von Oracle Linux und HP aufgenommen"
        },
        {
          "date": "2023-05-25T22:00:00.000+00:00",
          "number": "34",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-05-29T22:00:00.000+00:00",
          "number": "35",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2023-05-31T22:00:00.000+00:00",
          "number": "36",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-06-05T22:00:00.000+00:00",
          "number": "37",
          "summary": "Neue Updates von Red Hat und XEROX aufgenommen"
        },
        {
          "date": "2023-06-06T22:00:00.000+00:00",
          "number": "38",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-06-14T22:00:00.000+00:00",
          "number": "39",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-06-20T22:00:00.000+00:00",
          "number": "40",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-06-22T22:00:00.000+00:00",
          "number": "41",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-06-25T22:00:00.000+00:00",
          "number": "42",
          "summary": "Neue Updates von SUSE und Red Hat aufgenommen"
        },
        {
          "date": "2023-06-26T22:00:00.000+00:00",
          "number": "43",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-06-27T22:00:00.000+00:00",
          "number": "44",
          "summary": "Neue Updates von HITACHI aufgenommen"
        },
        {
          "date": "2023-06-28T22:00:00.000+00:00",
          "number": "45",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-07-05T22:00:00.000+00:00",
          "number": "46",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-07-06T22:00:00.000+00:00",
          "number": "47",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-07-17T22:00:00.000+00:00",
          "number": "48",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-07-20T22:00:00.000+00:00",
          "number": "49",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-07-24T22:00:00.000+00:00",
          "number": "50",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-08-01T22:00:00.000+00:00",
          "number": "51",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-08-03T22:00:00.000+00:00",
          "number": "52",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-08-07T22:00:00.000+00:00",
          "number": "53",
          "summary": "Neue Updates von Siemens aufgenommen"
        },
        {
          "date": "2023-08-17T22:00:00.000+00:00",
          "number": "54",
          "summary": "Neue Updates von ORACLE aufgenommen"
        },
        {
          "date": "2023-09-05T22:00:00.000+00:00",
          "number": "55",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-09-17T22:00:00.000+00:00",
          "number": "56",
          "summary": "Neue Updates von HP aufgenommen"
        },
        {
          "date": "2023-09-18T22:00:00.000+00:00",
          "number": "57",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-09-25T22:00:00.000+00:00",
          "number": "58",
          "summary": "Neue Updates von HITACHI aufgenommen"
        },
        {
          "date": "2023-09-27T22:00:00.000+00:00",
          "number": "59",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2023-10-03T22:00:00.000+00:00",
          "number": "60",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-10-31T23:00:00.000+00:00",
          "number": "61",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-12-07T23:00:00.000+00:00",
          "number": "62",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2023-12-12T23:00:00.000+00:00",
          "number": "63",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2024-01-02T23:00:00.000+00:00",
          "number": "64",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2024-01-17T23:00:00.000+00:00",
          "number": "65",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-01-25T23:00:00.000+00:00",
          "number": "66",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2024-02-04T23:00:00.000+00:00",
          "number": "67",
          "summary": "Neue Updates von Gentoo aufgenommen"
        },
        {
          "date": "2024-02-27T23:00:00.000+00:00",
          "number": "68",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2024-03-18T23:00:00.000+00:00",
          "number": "69",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2024-03-27T23:00:00.000+00:00",
          "number": "70",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-04-24T22:00:00.000+00:00",
          "number": "71",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-06-03T22:00:00.000+00:00",
          "number": "72",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2024-06-04T22:00:00.000+00:00",
          "number": "73",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-06-13T22:00:00.000+00:00",
          "number": "74",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2024-06-26T22:00:00.000+00:00",
          "number": "75",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2024-07-23T22:00:00.000+00:00",
          "number": "76",
          "summary": "Neue Updates aufgenommen"
        }
      ],
      "status": "final",
      "version": "76"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Aruba ArubaOS",
            "product": {
              "name": "Aruba ArubaOS",
              "product_id": "T021926",
              "product_identification_helper": {
                "cpe": "cpe:/o:arubanetworks:arubaos:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Aruba ClearPass Policy Manager",
            "product": {
              "name": "Aruba ClearPass Policy Manager",
              "product_id": "T023403",
              "product_identification_helper": {
                "cpe": "cpe:/a:arubanetworks:clearpass_policy_manager:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Aruba EdgeConnect",
            "product": {
              "name": "Aruba EdgeConnect",
              "product_id": "T027755",
              "product_identification_helper": {
                "cpe": "cpe:/a:aruba:edgeconnect:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Aruba Switch",
            "product": {
              "name": "Aruba Switch",
              "product_id": "T016786",
              "product_identification_helper": {
                "cpe": "cpe:/h:arubanetworks:switch:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Aruba"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Dell Computer",
            "product": {
              "name": "Dell Computer",
              "product_id": "T006498",
              "product_identification_helper": {
                "cpe": "cpe:/o:dell:dell_computer:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c19.10",
                "product": {
                  "name": "Dell NetWorker \u003c19.10",
                  "product_id": "T032354",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:dell:networker:19.10"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "NetWorker"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Dell PowerEdge",
                "product": {
                  "name": "Dell PowerEdge",
                  "product_id": "T019535",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:dell:poweredge:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Dell PowerEdge",
                "product": {
                  "name": "Dell PowerEdge",
                  "product_id": "T033533",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:dell:poweredge:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "PowerEdge"
          }
        ],
        "category": "vendor",
        "name": "Dell"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "EMC Avamar",
            "product": {
              "name": "EMC Avamar",
              "product_id": "T014381",
              "product_identification_helper": {
                "cpe": "cpe:/a:emc:avamar:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "EMC"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "F5 BIG-IP",
            "product": {
              "name": "F5 BIG-IP",
              "product_id": "T001663",
              "product_identification_helper": {
                "cpe": "cpe:/a:f5:big-ip:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "F5"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "FreeBSD Project FreeBSD OS",
            "product": {
              "name": "FreeBSD Project FreeBSD OS",
              "product_id": "4035",
              "product_identification_helper": {
                "cpe": "cpe:/o:freebsd:freebsd:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "FreeBSD Project"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Gentoo Linux",
            "product": {
              "name": "Gentoo Linux",
              "product_id": "T012167",
              "product_identification_helper": {
                "cpe": "cpe:/o:gentoo:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Gentoo"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cv8.5",
                "product": {
                  "name": "HPE OneView \u003cv8.5",
                  "product_id": "T029950",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hp:oneview:v8.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cv6.60.05 LTS",
                "product": {
                  "name": "HPE OneView \u003cv6.60.05 LTS",
                  "product_id": "T029951",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hp:oneview:v6.60.05_lts"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OneView"
          }
        ],
        "category": "vendor",
        "name": "HPE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Hitachi Command Suite",
            "product": {
              "name": "Hitachi Command Suite",
              "product_id": "T010951",
              "product_identification_helper": {
                "cpe": "cpe:/a:hitachi:command_suite:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Hitachi Configuration Manager",
            "product": {
              "name": "Hitachi Configuration Manager",
              "product_id": "T020304",
              "product_identification_helper": {
                "cpe": "cpe:/a:hitachi:configuration_manager:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Hitachi"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Hitachi Energy AFS",
            "product": {
              "name": "Hitachi Energy AFS",
              "product_id": "T016942",
              "product_identification_helper": {
                "cpe": "cpe:/h:abb:afs:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Hitachi Energy RTU500",
            "product": {
              "name": "Hitachi Energy RTU500",
              "product_id": "T027844",
              "product_identification_helper": {
                "cpe": "cpe:/h:abb:rtu500:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "670",
                "product": {
                  "name": "Hitachi Energy Relion 670",
                  "product_id": "T016943",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:relion:670"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "650",
                "product": {
                  "name": "Hitachi Energy Relion 650",
                  "product_id": "T016944",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:relion:650"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "SAM600-IO",
                "product": {
                  "name": "Hitachi Energy Relion SAM600-IO",
                  "product_id": "T016945",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:relion:sam600-io"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Relion"
          }
        ],
        "category": "vendor",
        "name": "Hitachi Energy"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.1",
                "product": {
                  "name": "IBM AIX 7.1",
                  "product_id": "153340",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:ibm:aix:7.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.2",
                "product": {
                  "name": "IBM AIX 7.2",
                  "product_id": "434967",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:ibm:aix:7.2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.3",
                "product": {
                  "name": "IBM AIX 7.3",
                  "product_id": "T021486",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:ibm:aix:7.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "AIX"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "21.0.2",
                "product": {
                  "name": "IBM Business Automation Workflow 21.0.2",
                  "product_id": "1055431",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:21.0.2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "21.0.3",
                "product": {
                  "name": "IBM Business Automation Workflow 21.0.3",
                  "product_id": "1150328",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:21.0.3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "22.0.1",
                "product": {
                  "name": "IBM Business Automation Workflow 22.0.1",
                  "product_id": "1268578",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:22.0.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "18.0.0.0",
                "product": {
                  "name": "IBM Business Automation Workflow 18.0.0.0",
                  "product_id": "389078",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:18.0.0.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "18.0.0.1",
                "product": {
                  "name": "IBM Business Automation Workflow 18.0.0.1",
                  "product_id": "389079",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:18.0.0.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "18.0.0.2",
                "product": {
                  "name": "IBM Business Automation Workflow 18.0.0.2",
                  "product_id": "428468",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:18.0.0.2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "19.0.0.1",
                "product": {
                  "name": "IBM Business Automation Workflow 19.0.0.1",
                  "product_id": "433292",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:19.0.0.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "19.0.0.2",
                "product": {
                  "name": "IBM Business Automation Workflow 19.0.0.2",
                  "product_id": "672243",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:19.0.0.2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "19.0.0.3",
                "product": {
                  "name": "IBM Business Automation Workflow 19.0.0.3",
                  "product_id": "672244",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:19.0.0.3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "20.0.0.1",
                "product": {
                  "name": "IBM Business Automation Workflow 20.0.0.1",
                  "product_id": "867559",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:20.0.0.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "20.0.0.2",
                "product": {
                  "name": "IBM Business Automation Workflow 20.0.0.2",
                  "product_id": "867560",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:20.0.0.2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "21.0.3.1",
                "product": {
                  "name": "IBM Business Automation Workflow 21.0.3.1",
                  "product_id": "T025512",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:21.0.3.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "22.0.2",
                "product": {
                  "name": "IBM Business Automation Workflow 22.0.2",
                  "product_id": "T025770",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:22.0.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Business Automation Workflow"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.0.1.12",
                "product": {
                  "name": "IBM DataPower Gateway \u003c10.0.1.12",
                  "product_id": "T026646",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:10.0.1.12"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.5.0.4",
                "product": {
                  "name": "IBM DataPower Gateway \u003c10.5.0.4",
                  "product_id": "T026647",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:10.5.0.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c2018.4.1.26",
                "product": {
                  "name": "IBM DataPower Gateway \u003c2018.4.1.26",
                  "product_id": "T027562",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:2018.4.1.26"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.0.4.0sr3",
                "product": {
                  "name": "IBM DataPower Gateway \u003c10.0.4.0sr3",
                  "product_id": "T027563",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:10.0.4.0sr3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.0.1.12",
                "product": {
                  "name": "IBM DataPower Gateway \u003c10.0.1.12",
                  "product_id": "T027564",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:10.0.1.12"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "DataPower Gateway"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.7",
                "product": {
                  "name": "IBM InfoSphere Information Server 11.7",
                  "product_id": "444803",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:infosphere_information_server:11.7"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "InfoSphere Information Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.0.0.0-10.0.0.26",
                "product": {
                  "name": "IBM Integration Bus 10.0.0.0-10.0.0.26",
                  "product_id": "T023793",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:integration_bus:10.0.0.0_-_10.0.0.26"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "10.1",
                "product": {
                  "name": "IBM Integration Bus 10.1",
                  "product_id": "T026788",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:integration_bus:10.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Integration Bus"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "9.1 LTS",
                "product": {
                  "name": "IBM MQ 9.1 LTS",
                  "product_id": "T015789",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:9.1_lts"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8",
                "product": {
                  "name": "IBM MQ 8.0",
                  "product_id": "T015791",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:8.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "9.0 LTS",
                "product": {
                  "name": "IBM MQ 9.0 LTS",
                  "product_id": "T015792",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:9.0_lts"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "9.2 LTS",
                "product": {
                  "name": "IBM MQ 9.2 LTS",
                  "product_id": "T018186",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:9.2_lts"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "IBM MQ",
                "product": {
                  "name": "IBM MQ",
                  "product_id": "T021398",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "9.3 LTS",
                "product": {
                  "name": "IBM MQ 9.3 LTS",
                  "product_id": "T024689",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:9.3_lts"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "HPE NonStop 8.1.0",
                "product": {
                  "name": "IBM MQ HPE NonStop 8.1.0",
                  "product_id": "T026652",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:hpe_nonstop_8.1.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "MQ"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "v9",
                "product": {
                  "name": "IBM Power Hardware Management Console v9",
                  "product_id": "T021107",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:hardware_management_console:v9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v10",
                "product": {
                  "name": "IBM Power Hardware Management Console v10",
                  "product_id": "T023373",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:hardware_management_console:v10"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "DS8000",
                "product": {
                  "name": "IBM Power Hardware Management Console DS8000",
                  "product_id": "T028436",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:hardware_management_console:ds8000"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Power Hardware Management Console"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.5",
                "product": {
                  "name": "IBM QRadar SIEM 7.5",
                  "product_id": "T022954",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:qradar_siem:7.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.5.0 UP8",
                "product": {
                  "name": "IBM QRadar SIEM \u003c7.5.0 UP8",
                  "product_id": "T033681",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:qradar_siem:7.5.0_up8"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "QRadar SIEM"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c8.0.0.24",
                "product": {
                  "name": "IBM Rational Build Forge \u003c8.0.0.24",
                  "product_id": "T030689",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:rational_build_forge:8.0.0.24"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Rational Build Forge"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.1.0.5",
                "product": {
                  "name": "IBM Rational ClearCase \u003c9.1.0.5",
                  "product_id": "T030198",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:rational_clearcase:9.1.0.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.0.2.8",
                "product": {
                  "name": "IBM Rational ClearCase \u003c9.0.2.8",
                  "product_id": "T030199",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:rational_clearcase:9.0.2.8"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Rational ClearCase"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.0.3",
                "product": {
                  "name": "IBM Rational ClearQuest \u003c10.0.3",
                  "product_id": "T030177",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:rational_clearquest:10.0.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.0.2.8",
                "product": {
                  "name": "IBM Rational ClearQuest \u003c9.0.2.8",
                  "product_id": "T030204",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:rational_clearquest:9.0.2.8"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.1.0.5",
                "product": {
                  "name": "IBM Rational ClearQuest \u003c9.1.0.5",
                  "product_id": "T030211",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:rational_clearquest:9.1.0.5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Rational ClearQuest"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.0.X",
                "product": {
                  "name": "IBM Security Verify Access 10.0.X",
                  "product_id": "T026175",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:security_verify_access:10.0.x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "10.0.0.0-10.0.6.1",
                "product": {
                  "name": "IBM Security Verify Access 10.0.0.0-10.0.6.1",
                  "product_id": "T031895",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:security_verify_access:10.0.0.0_-_10.0.6.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Security Verify Access"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "plus 10.1",
                "product": {
                  "name": "IBM Spectrum Protect plus 10.1",
                  "product_id": "T015895",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_protect:plus_10.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "10.1.14",
                "product": {
                  "name": "IBM Spectrum Protect 10.1.14",
                  "product_id": "T026783",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_protect:10.1.14"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.1.17.2",
                "product": {
                  "name": "IBM Spectrum Protect \u003c8.1.17.2",
                  "product_id": "T026807",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_protect:8.1.17.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spectrum Protect"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.72 SU2",
                "product": {
                  "name": "LANCOM LCOS 10.72 SU2",
                  "product_id": "T026546",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:10.72_su2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "10.50 RU10",
                "product": {
                  "name": "LANCOM LCOS 10.50 RU10",
                  "product_id": "T026547",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:10.50_ru10"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "10.42 SU10",
                "product": {
                  "name": "LANCOM LCOS 10.42 SU10",
                  "product_id": "T026548",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:10.42_su10"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "FX 10.11",
                "product": {
                  "name": "LANCOM LCOS FX 10.11",
                  "product_id": "T026549",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:fx_10.11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "LX 6.10",
                "product": {
                  "name": "LANCOM LCOS LX 6.10",
                  "product_id": "T026550",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:lx_6.10"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "LX 5.38 SU1",
                "product": {
                  "name": "LANCOM LCOS LX 5.38 SU1",
                  "product_id": "T026551",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:lx_5.38_su1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "LX 5.36 SU2",
                "product": {
                  "name": "LANCOM LCOS LX 5.36 SU2",
                  "product_id": "T026552",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:lx_5.36_su2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "SX 4.20",
                "product": {
                  "name": "LANCOM LCOS SX 4.20",
                  "product_id": "T026553",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:sx_4.20"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "SX 5.20 RU3",
                "product": {
                  "name": "LANCOM LCOS SX 5.20 RU3",
                  "product_id": "T026554",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:sx_5.20_ru3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "LCOS"
          }
        ],
        "category": "vendor",
        "name": "LANCOM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.06.012",
                "product": {
                  "name": "Meinberg LANTIME 7.06.012",
                  "product_id": "T026735",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:meinberg:lantime:7.06.012"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.06.013",
                "product": {
                  "name": "Meinberg LANTIME \u003c7.06.013",
                  "product_id": "T027496",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:meinberg:lantime:7.06.013"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "LANTIME"
          }
        ],
        "category": "vendor",
        "name": "Meinberg"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "NetApp Data ONTAP",
            "product": {
              "name": "NetApp Data ONTAP",
              "product_id": "7654",
              "product_identification_helper": {
                "cpe": "cpe:/a:netapp:data_ontap:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "NetApp"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Open Source CentOS",
            "product": {
              "name": "Open Source CentOS",
              "product_id": "1727",
              "product_identification_helper": {
                "cpe": "cpe:/o:centos:centos:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.0.8",
                "product": {
                  "name": "Open Source OpenSSL \u003c3.0.8",
                  "product_id": "T026178",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openssl:openssl:3.0.8"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c1.1.1t",
                "product": {
                  "name": "Open Source OpenSSL \u003c1.1.1t",
                  "product_id": "T026179",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openssl:openssl:1.1.1t"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c1.0.2zg",
                "product": {
                  "name": "Open Source OpenSSL \u003c1.0.2zg",
                  "product_id": "T026180",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openssl:openssl:1.0.2zg"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenSSL"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3",
                "product": {
                  "name": "Oracle VM 3",
                  "product_id": "T019617",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:vm:3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "VM"
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "QNAP NAS",
            "product": {
              "name": "QNAP NAS",
              "product_id": "T017100",
              "product_identification_helper": {
                "cpe": "cpe:/h:qnap:nas:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "QNAP"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Multicluster Engine",
                "product": {
                  "name": "Red Hat Enterprise Linux Multicluster Engine",
                  "product_id": "T027598",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:multicluster_engine"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Container Platform \u003c4.11.43",
                "product": {
                  "name": "Red Hat OpenShift Container Platform \u003c4.11.43",
                  "product_id": "T028132",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform__4.11.43"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Container Platform \u003c4.13.4",
                "product": {
                  "name": "Red Hat OpenShift Container Platform \u003c4.13.4",
                  "product_id": "T028225",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform__4.13.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Container Platform \u003c4.12.22",
                "product": {
                  "name": "Red Hat OpenShift Container Platform \u003c4.12.22",
                  "product_id": "T028307",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform__4.12.22"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenShift"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1500",
                "product": {
                  "name": "Siemens SIMATIC S7 1500",
                  "product_id": "T019436",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:siemens:simatic_s7:1500"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Siemens SIMATIC S7",
                "product": {
                  "name": "Siemens SIMATIC S7",
                  "product_id": "T020086",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:siemens:simatic_s7:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC S7"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2024.2",
                "product": {
                  "name": "SolarWinds Platform \u003c2024.2",
                  "product_id": "T035149",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:solarwinds:orion_platform:2024.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Platform"
          }
        ],
        "category": "vendor",
        "name": "SolarWinds"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.2.1.7-49sv",
                "product": {
                  "name": "SonicWall SMA \u003c10.2.1.7-49sv",
                  "product_id": "897623",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:sonicwall:secure_mobile_access:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SMA"
          }
        ],
        "category": "vendor",
        "name": "SonicWall"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.5.0",
                "product": {
                  "name": "Tenable Security Nessus \u003c10.5.0",
                  "product_id": "T026604",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:tenable:nessus:10.5.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.15.9",
                "product": {
                  "name": "Tenable Security Nessus 8.15.9",
                  "product_id": "T026648",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:tenable:nessus:8.15.9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "10.4.3",
                "product": {
                  "name": "Tenable Security Nessus 10.4.3",
                  "product_id": "T026649",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:tenable:nessus:10.4.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Agent \u003c10.3.2",
                "product": {
                  "name": "Tenable Security Nessus Agent \u003c10.3.2",
                  "product_id": "T026696",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:tenable:nessus:agent__10.3.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Agent \u003c8.3.5",
                "product": {
                  "name": "Tenable Security Nessus Agent \u003c8.3.5",
                  "product_id": "T026697",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:tenable:nessus:agent__8.3.5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Nessus"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.2.1",
                "product": {
                  "name": "Tenable Security Nessus Network Monitor \u003c6.2.1",
                  "product_id": "T027665",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:tenable:nessus_network_monitor:6.2.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Nessus Network Monitor"
          }
        ],
        "category": "vendor",
        "name": "Tenable Security"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "v7",
                "product": {
                  "name": "Xerox FreeFlow Print Server v7",
                  "product_id": "T015631",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:xerox:freeflow_print_server:v7"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FreeFlow Print Server"
          }
        ],
        "category": "vendor",
        "name": "Xerox"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4203",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. Bei der X.509-Zertifikats\u00fcberpr\u00fcfung kann ein Lesepuffer\u00fcberlauf ausgel\u00f6st werden. Ein privilegierter Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2022-4203"
    },
    {
      "cve": "CVE-2022-4304",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. In der RSA-Entschl\u00fcsselungsimplementierung von OpenSSL gibt es einen zeitbasierten Seitenkanal. Ein entfernter, anonymer Angreifer kann diese Schwachstelle unter bestimmten Voraussetzungen ausnutzen, um Chiffretext \u00fcber ein Netzwerk wiederherzustellen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2022-4304"
    },
    {
      "cve": "CVE-2022-4450",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. In der \"PEM_read_bio_ex\" Funktion besteht ein Double-free Problem. Ein entfernter, anonymer Angreifer kann diese Schwachstelle durch das Senden einer speziell bearbeiteten PEM-Datei ausnutzen, um einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2022-4450"
    },
    {
      "cve": "CVE-2023-0215",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. In der \"BIO_new_NDEF\" Funktion besteht ein use-after-free Problem. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2023-0215"
    },
    {
      "cve": "CVE-2023-0216",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. Beim Lesen kann eine ung\u00fcltige Zeiger-Dereferenz ausgel\u00f6st werden, wenn eine Anwendung versucht, fehlerhafte PKCS7-Daten mit den Funktionen \"d2i_PKCS7()\", \"d2i_PKCS7_bio()\" oder \"d2i_PKCS7_fp()\" zu laden. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Servie zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2023-0216"
    },
    {
      "cve": "CVE-2023-0217",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. Beim Lesen kann eine ung\u00fcltige Zeiger-Dereferenz ausgel\u00f6st werden, wenn eine Anwendung versucht, einen missgebildeten \u00f6ffentlichen DSA-Schl\u00fcssel mit der Funktion \"EVP_PKEY_public_check()\" zu \u00fcberpr\u00fcfen. Ein entfenrter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2023-0217"
    },
    {
      "cve": "CVE-2023-0286",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. Wenn OpenSSL X.400 Adressen innerhalb eines \"X.509 GeneralName\" verarbeitet weren kommt es zu einem Type Confusion Problem. Ein Angreifer kann diese Schwachstelle ausnutzen, um Informationen offenzulegen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2023-0286"
    },
    {
      "cve": "CVE-2023-0401",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. Wenn Signaturen auf PKCS7-signierten oder \"signedAndEnveloped\" Daten \u00fcberpr\u00fcft werden kommt es unter bestimmten Umst\u00e4nden zu einer NULL-Zeiger Dereferenzierung. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2023-0401"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "OpenSSL ist eine im Quelltext frei verf\u00fcgbare Bibliothek, die Secure Sockets Layer (SSL) und Transport Layer Security (TLS) implementiert.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren, Informationen offenzulegen oder Chiffretext \u00fcber ein Netzwerk wiederherzustellen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-0304 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0304.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-0304 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0304"
      },
      {
        "category": "external",
        "summary": "OpenSSL Security Advisory vom 2023-02-07",
        "url": "https://www.openssl.org/news/secadv/20230207.txt"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2023-1935 vom 2023-02-08",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-1935.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2023-1683 vom 2023-02-08",
        "url": "https://alas.aws.amazon.com/ALAS-2023-1683.html"
      },
      {
        "category": "external",
        "summary": "Aruba Product Security Advisory",
        "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-001.txt"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2023-1934 vom 2023-02-08",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-1934.html"
      },
      {
        "category": "external",
        "summary": "NetApp Security Advisory NTAP-20230214-0011 vom 2023-02-14",
        "url": "https://security.netapp.com/advisory/ntap-20230214-0011/"
      },
      {
        "category": "external",
        "summary": "FreeBSD Security Advisory FREEBSD-SA-23:03.OPENSSL vom 2023-02-16",
        "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:03.openssl.asc"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-3325 vom 2023-02-20",
        "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00019.html"
      },
      {
        "category": "external",
        "summary": "McAfee Security Bulletin SB10395 vom 2023-02-22",
        "url": "https://kcm.trellix.com/corporate/index?page=content\u0026id=SB10395\u0026viewlocale=en_US\u0026platinum_status=false\u0026locale=en_US"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:0482-1 vom 2023-02-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013880.html"
      },
      {
        "category": "external",
        "summary": "LANCOM Sicherheitshinweise",
        "url": "https://www.lancom-systems.de/service-support/soforthilfe/allgemeine-sicherheitshinweise/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:0581-1 vom 2023-02-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013933.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:0946 vom 2023-02-28",
        "url": "https://access.redhat.com/errata/RHSA-2023:0946"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-0946 vom 2023-02-28",
        "url": "http://linux.oracle.com/errata/ELSA-2023-0946.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6959033 vom 2023-03-01",
        "url": "https://www.ibm.com/support/pages/node/6959033"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:0584-1 vom 2023-03-01",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-March/013952.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-12152 vom 2023-03-01",
        "url": "https://linux.oracle.com/errata/ELSA-2023-12152.html"
      },
      {
        "category": "external",
        "summary": "SonicWall Product Notifications",
        "url": "https://www.sonicwall.com/support/product-notification/sma-100-series-openssl-library-update-in-10-2-1-7/230228123000903/"
      },
      {
        "category": "external",
        "summary": "Tenable Security Advisory TNS-2023-09 vom 2023-03-02",
        "url": "https://www.tenable.com/security/tns-2023-09"
      },
      {
        "category": "external",
        "summary": "Tenable Security Advisory TNS-2023-10 vom 2023-03-07",
        "url": "https://www.tenable.com/security/tns-2023-10"
      },
      {
        "category": "external",
        "summary": "Tenable Security Advisory TNS-2023-11 vom 2023-03-07",
        "url": "https://www.tenable.com/security/tns-2023-11"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6960563 vom 2023-03-07",
        "url": "https://www.ibm.com/support/pages/node/6960563"
      },
      {
        "category": "external",
        "summary": "### vom 2023-03-07",
        "url": "https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6960511 vom 2023-03-07",
        "url": "https://www.ibm.com/support/pages/node/6960511"
      },
      {
        "category": "external",
        "summary": "Tenable Security Advisory TNS-2023-12 vom 2023-03-09",
        "url": "https://www.tenable.com/security/tns-2023-12"
      },
      {
        "category": "external",
        "summary": "Tenable Security Advisory TNS-2023-13 vom 2023-03-09",
        "url": "https://www.tenable.com/security/tns-2023-13"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:0684-1 vom 2023-03-09",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-March/014009.html"
      },
      {
        "category": "external",
        "summary": "Siemens Security Bulletin by Siemens ProductCERT",
        "url": "https://cert-portal.siemens.com/productcert/html/ssb-439005.html"
      },
      {
        "category": "external",
        "summary": "Meinberg Security Advisory MBGSA-2023.02 vom 2023-03-14",
        "url": "https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2023-02-meinberg-lantime-firmware-v7-06-012.htm"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:1199 vom 2023-03-14",
        "url": "https://access.redhat.com/errata/RHSA-2023:1199"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6957718 vom 2023-03-16",
        "url": "https://www.ibm.com/support/pages/node/6957718"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6963634 vom 2023-03-16",
        "url": "https://www.cybersecurity-help.cz/vdb/SB2023031618"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6963784 vom 2023-03-20",
        "url": "https://www.ibm.com/support/pages/node/6963784"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6963786 vom 2023-03-20",
        "url": "https://www.cybersecurity-help.cz/vdb/SB2023032014"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:1335 vom 2023-03-20",
        "url": "https://access.redhat.com/errata/RHSA-2023:1335"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-1335 vom 2023-03-20",
        "url": "http://linux.oracle.com/errata/ELSA-2023-1335.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6964854 vom 2023-03-21",
        "url": "https://aix.software.ibm.com/aix/efixes/security/openssl_advisory38.asc"
      },
      {
        "category": "external",
        "summary": "Dell Knowledge Base Article",
        "url": "https://www.dell.com/support/kbdoc/en-us/000221474/dsa-2024-059-security-update-for-dell-networker-multiple-components-vulnerabilities"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:1405 vom 2023-03-22",
        "url": "https://access.redhat.com/errata/RHSA-2023:1405"
      },
      {
        "category": "external",
        "summary": "CentOS Security Advisory CESA-2023:1335 vom 2023-03-22",
        "url": "https://lists.centos.org/pipermail/centos-announce/2023-March/086392.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-12205 vom 2023-03-22",
        "url": "https://linux.oracle.com/errata/ELSA-2023-12205.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-1405 vom 2023-03-23",
        "url": "http://linux.oracle.com/errata/ELSA-2023-1405.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-12213 vom 2023-03-28",
        "url": "https://linux.oracle.com/errata/ELSA-2023-12213.html"
      },
      {
        "category": "external",
        "summary": "QNAP Security Advisory QSA-23-15 vom 2023-03-29",
        "url": "https://www.qnap.com/de-de/security-advisory/QSA-23-15"
      },
      {
        "category": "external",
        "summary": "F5 K000132941 vom 2023-04-06",
        "url": "https://my.f5.com/manage/s/article/K000132941"
      },
      {
        "category": "external",
        "summary": "F5 K000132943 vom 2023-04-06",
        "url": "https://my.f5.com/manage/s/article/K000132943"
      },
      {
        "category": "external",
        "summary": "F5 K000132946 vom 2023-04-06",
        "url": "https://my.f5.com/manage/s/article/K000132946"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2023-113 vom 2023-12-13",
        "url": "https://www.dell.com/support/kbdoc/000211759/dsa-2023-="
      },
      {
        "category": "external",
        "summary": "Meinberg Security Advisory MBGSA-2023.02 vom 2023-03-23",
        "url": "https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2023-02-lantime-firmware-v7-06-013.htm"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6986323 vom 2023-04-26",
        "url": "https://www.ibm.com/support/pages/node/6986323"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:2022 vom 2023-04-26",
        "url": "https://access.redhat.com/errata/RHSA-2023:2022"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6987461 vom 2023-05-01",
        "url": "https://www.ibm.com/support/pages/node/6987461"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:2098 vom 2023-05-03",
        "url": "https://access.redhat.com/errata/RHSA-2023:2098"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-12326 vom 2023-05-04",
        "url": "https://linux.oracle.com/errata/ELSA-2023-12326.html"
      },
      {
        "category": "external",
        "summary": "Tenable Security Advisory TNS-2023-19 vom 2023-05-10",
        "url": "https://www.tenable.com/security/tns-2023-19"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:2165 vom 2023-05-09",
        "url": "https://access.redhat.com/errata/RHSA-2023:2165"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6985831 vom 2023-05-10",
        "url": "https://www.ibm.com/support/pages/node/6985831"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:2932 vom 2023-05-16",
        "url": "https://access.redhat.com/errata/RHSA-2023:2932"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6983555 vom 2023-05-17",
        "url": "https://www.ibm.com/support/pages/node/6983555"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-2932 vom 2023-05-24",
        "url": "https://linux.oracle.com/errata/ELSA-2023-2932.html"
      },
      {
        "category": "external",
        "summary": "Hitachi Cybersecurity Advisory vom 2023-04-25",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-02"
      },
      {
        "category": "external",
        "summary": "HP Security Bulletin",
        "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04445en_us"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6998707 vom 2023-05-26",
        "url": "https://www.ibm.com/support/pages/node/6998707"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2023-134 vom 2023-05-26",
        "url": "https://www.dell.com/support/kbdoc/de-de/000214129/dsa-2023-134-security-update-for-dell-poweredge-server-for-multiple-openssl-vulnerabilities"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3408 vom 2023-06-01",
        "url": "https://access.redhat.com/errata/RHSA-2023:3408"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2633-1 vom 2024-02-27",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-February/018032.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2634-1 vom 2024-02-27",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-February/018031.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3354 vom 2023-06-05",
        "url": "https://access.redhat.com/errata/RHSA-2023:3354"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3355 vom 2023-06-05",
        "url": "https://access.redhat.com/errata/RHSA-2023:3355"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3420 vom 2023-06-05",
        "url": "https://access.redhat.com/errata/RHSA-2023:3420"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3421 vom 2023-06-05",
        "url": "https://access.redhat.com/errata/RHSA-2023:3421"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3455 vom 2023-06-06",
        "url": "https://access.redhat.com/errata/RHSA-2023:3455"
      },
      {
        "category": "external",
        "summary": "XEROX Security Advisory XRX23-008 vom 2023-06-06",
        "url": "https://security.business.xerox.com/wp-content/uploads/2023/06/Xerox-Security-Bulletin-XRX23-008-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v7.pdf"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:0305-2 vom 2023-06-06",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-June/015094.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3542 vom 2023-06-14",
        "url": "https://access.redhat.com/errata/RHSA-2023:3542"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7005589 vom 2023-06-21",
        "url": "https://www.ibm.com/support/pages/node/7005589"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3612 vom 2023-06-23",
        "url": "https://access.redhat.com/errata/RHSA-2023:3614"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:29171-1 vom 2023-06-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-June/015287.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2623-1 vom 2023-06-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-June/015285.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2622-1 vom 2023-06-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-June/015286.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2624-1 vom 2023-06-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-June/015284.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3615 vom 2023-06-22",
        "url": "https://access.redhat.com/errata/RHSA-2023:3615"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2648-1 vom 2023-06-27",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-June/015323.html"
      },
      {
        "category": "external",
        "summary": "Hitachi Energy CYBERSECURITY ADVISORY vom 2023-06-27",
        "url": "https://library.e.abb.com/public/4fffbb03a11143c0b70e57acbd1c9f66/8DBD000157-VU-2023-004-OpenSSL_Relion_670_650_Rev1.pdf"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7007815 vom 2023-06-28",
        "url": "https://www.ibm.com/support/pages/node/7007815"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7009735 vom 2023-07-05",
        "url": "https://www.ibm.com/support/pages/node/7009735"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7010099 vom 2023-07-06",
        "url": "https://www.ibm.com/support/pages/node/7010099"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7006449 vom 2023-07-07",
        "url": "https://www.ibm.com/support/pages/node/7006449"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4128 vom 2023-07-18",
        "url": "https://access.redhat.com/errata/RHSA-2023:4128"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4124 vom 2023-07-18",
        "url": "https://access.redhat.com/errata/RHSA-2023:4124"
      },
      {
        "category": "external",
        "summary": "Gentoo Linux Security Advisory GLSA-202402-08 vom 2024-02-04",
        "url": "https://security.gentoo.org/glsa/202402-08"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4091 vom 2023-07-20",
        "url": "https://access.redhat.com/errata/RHSA-2023:4091"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4252 vom 2023-07-25",
        "url": "https://access.redhat.com/errata/RHSA-2023:4252"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:3096-1 vom 2023-08-01",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-August/015724.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:3179-1 vom 2023-08-03",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-August/015773.html"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory SSA-264815 vom 2023-08-08",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-264815.html"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory SSA-264814 vom 2023-08-08",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-264814.html"
      },
      {
        "category": "external",
        "summary": "ORACLE OVMSA-2023-0013 vom 2023-08-17",
        "url": "https://oss.oracle.com/pipermail/oraclevm-errata/2023-August/001082.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7108821 vom 2024-01-17",
        "url": "https://www.ibm.com/support/pages/node/7108821"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4982 vom 2023-09-05",
        "url": "https://access.redhat.com/errata/RHSA-2023:4982"
      },
      {
        "category": "external",
        "summary": "HPE Security Bulletin",
        "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbgn04530en_us"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:5209 vom 2023-09-19",
        "url": "https://access.redhat.com/errata/RHSA-2023:5209"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2023-135 vom 2023-09-26",
        "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-135/index.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALASOPENSSL-SNAPSAFE-2023-002 vom 2023-09-27",
        "url": "https://alas.aws.amazon.com/AL2/ALASOPENSSL-SNAPSAFE-2023-002.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7035370 vom 2023-10-03",
        "url": "https://www.ibm.com/support/pages/node/7035370"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7041682 vom 2023-10-04",
        "url": "https://www.ibm.com/support/pages/node/7041682"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-6564-1 vom 2024-01-03",
        "url": "https://ubuntu.com/security/notices/USN-6564-1"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7063708 vom 2023-10-31",
        "url": "https://www.ibm.com/support/pages/node/7063708"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-13027 vom 2023-12-07",
        "url": "https://linux.oracle.com/errata/ELSA-2023-13027.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-13024 vom 2023-12-07",
        "url": "https://linux.oracle.com/errata/ELSA-2023-13024.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-32790 vom 2023-12-07",
        "url": "https://linux.oracle.com/errata/ELSA-2023-32790.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-13025 vom 2023-12-07",
        "url": "https://linux.oracle.com/errata/ELSA-2023-13025.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-13026 vom 2023-12-07",
        "url": "https://linux.oracle.com/errata/ELSA-2023-13026.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-32791 vom 2023-12-07",
        "url": "https://linux.oracle.com/errata/ELSA-2023-32791.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2024-2502 vom 2024-03-19",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2024-2502.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7145367 vom 2024-03-27",
        "url": "https://www.ibm.com/support/pages/node/7145367"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-20865 vom 2024-04-25",
        "url": "https://linux.oracle.com/errata/ELSA-2024-20865.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-12343 vom 2024-04-25",
        "url": "https://linux.oracle.com/errata/ELSA-2024-12343.html"
      },
      {
        "category": "external",
        "summary": "SolarWinds Platform 2024.2 release notes vom 2024-06-04",
        "url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-2_release_notes.htm"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-12408 vom 2024-06-05",
        "url": "https://linux.oracle.com/errata/ELSA-2024-12408.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-23120 vom 2024-06-04",
        "url": "https://linux.oracle.com/errata/ELSA-2024-23120.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-12409 vom 2024-06-04",
        "url": "https://linux.oracle.com/errata/ELSA-2024-12409.html"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2023-207 vom 2024-06-13",
        "url": "https://www.dell.com/support/kbdoc/de-de/000216897/dsa-2023-207-security-update-for-dell-poweredge-t40-mini-tower-server-openssl-vulnerabilities"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2024-250 vom 2024-06-27",
        "url": "https://www.dell.com/support/kbdoc/de-de/000226426/dsa-2024-250-security-update-for-dell-avamar-dell-integrated-data-protection-appliance-idpa-security-update-for-multiple-vulnerabilities"
      },
      {
        "category": "external",
        "summary": "ICS Advisory vom 2024-07-23",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-205-02"
      }
    ],
    "source_lang": "en-US",
    "title": "OpenSSL: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-07-23T22:00:00.000+00:00",
      "generator": {
        "date": "2024-07-24T09:11:01.861+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2023-0304",
      "initial_release_date": "2023-02-07T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-02-07T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-02-08T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Amazon und Aruba aufgenommen"
        },
        {
          "date": "2023-02-09T23:00:00.000+00:00",
          "number": "3",
          "summary": "Referenz(en) aufgenommen: FEDORA-2023-A5564C0A3F, FEDORA-2023-57F33242BC"
        },
        {
          "date": "2023-02-14T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von NetApp aufgenommen"
        },
        {
          "date": "2023-02-16T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von FreeBSD aufgenommen"
        },
        {
          "date": "2023-02-19T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2023-02-22T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von McAfee aufgenommen"
        },
        {
          "date": "2023-02-23T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-02-27T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2023-02-28T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von SUSE, Red Hat und Oracle Linux aufgenommen"
        },
        {
          "date": "2023-03-01T23:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2023-03-02T23:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Tenable aufgenommen"
        },
        {
          "date": "2023-03-07T23:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Tenable, IBM und IBM-APAR aufgenommen"
        },
        {
          "date": "2023-03-09T23:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Tenable und SUSE aufgenommen"
        },
        {
          "date": "2023-03-13T23:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Siemens aufgenommen"
        },
        {
          "date": "2023-03-14T23:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-03-15T23:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-03-19T23:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-03-20T23:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Red Hat und Oracle Linux aufgenommen"
        },
        {
          "date": "2023-03-21T23:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-03-22T23:00:00.000+00:00",
          "number": "21",
          "summary": "Neue Updates von Red Hat, CentOS und Oracle Linux aufgenommen"
        },
        {
          "date": "2023-03-28T22:00:00.000+00:00",
          "number": "22",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2023-03-29T22:00:00.000+00:00",
          "number": "23",
          "summary": "Neue Updates von QNAP aufgenommen"
        },
        {
          "date": "2023-04-10T22:00:00.000+00:00",
          "number": "24",
          "summary": "Neue Informationen von F5 aufgenommen"
        },
        {
          "date": "2023-04-24T22:00:00.000+00:00",
          "number": "25",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2023-04-26T22:00:00.000+00:00",
          "number": "26",
          "summary": "Neue Updates von IBM und Red Hat aufgenommen"
        },
        {
          "date": "2023-05-01T22:00:00.000+00:00",
          "number": "27",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-05-03T22:00:00.000+00:00",
          "number": "28",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-05-04T22:00:00.000+00:00",
          "number": "29",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2023-05-09T22:00:00.000+00:00",
          "number": "30",
          "summary": "Neue Updates von Tenable und Red Hat aufgenommen"
        },
        {
          "date": "2023-05-10T22:00:00.000+00:00",
          "number": "31",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-05-16T22:00:00.000+00:00",
          "number": "32",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-05-23T22:00:00.000+00:00",
          "number": "33",
          "summary": "Neue Updates von Oracle Linux und HP aufgenommen"
        },
        {
          "date": "2023-05-25T22:00:00.000+00:00",
          "number": "34",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-05-29T22:00:00.000+00:00",
          "number": "35",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2023-05-31T22:00:00.000+00:00",
          "number": "36",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-06-05T22:00:00.000+00:00",
          "number": "37",
          "summary": "Neue Updates von Red Hat und XEROX aufgenommen"
        },
        {
          "date": "2023-06-06T22:00:00.000+00:00",
          "number": "38",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-06-14T22:00:00.000+00:00",
          "number": "39",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-06-20T22:00:00.000+00:00",
          "number": "40",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-06-22T22:00:00.000+00:00",
          "number": "41",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-06-25T22:00:00.000+00:00",
          "number": "42",
          "summary": "Neue Updates von SUSE und Red Hat aufgenommen"
        },
        {
          "date": "2023-06-26T22:00:00.000+00:00",
          "number": "43",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-06-27T22:00:00.000+00:00",
          "number": "44",
          "summary": "Neue Updates von HITACHI aufgenommen"
        },
        {
          "date": "2023-06-28T22:00:00.000+00:00",
          "number": "45",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-07-05T22:00:00.000+00:00",
          "number": "46",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-07-06T22:00:00.000+00:00",
          "number": "47",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-07-17T22:00:00.000+00:00",
          "number": "48",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-07-20T22:00:00.000+00:00",
          "number": "49",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-07-24T22:00:00.000+00:00",
          "number": "50",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-08-01T22:00:00.000+00:00",
          "number": "51",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-08-03T22:00:00.000+00:00",
          "number": "52",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-08-07T22:00:00.000+00:00",
          "number": "53",
          "summary": "Neue Updates von Siemens aufgenommen"
        },
        {
          "date": "2023-08-17T22:00:00.000+00:00",
          "number": "54",
          "summary": "Neue Updates von ORACLE aufgenommen"
        },
        {
          "date": "2023-09-05T22:00:00.000+00:00",
          "number": "55",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-09-17T22:00:00.000+00:00",
          "number": "56",
          "summary": "Neue Updates von HP aufgenommen"
        },
        {
          "date": "2023-09-18T22:00:00.000+00:00",
          "number": "57",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-09-25T22:00:00.000+00:00",
          "number": "58",
          "summary": "Neue Updates von HITACHI aufgenommen"
        },
        {
          "date": "2023-09-27T22:00:00.000+00:00",
          "number": "59",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2023-10-03T22:00:00.000+00:00",
          "number": "60",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-10-31T23:00:00.000+00:00",
          "number": "61",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-12-07T23:00:00.000+00:00",
          "number": "62",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2023-12-12T23:00:00.000+00:00",
          "number": "63",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2024-01-02T23:00:00.000+00:00",
          "number": "64",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2024-01-17T23:00:00.000+00:00",
          "number": "65",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-01-25T23:00:00.000+00:00",
          "number": "66",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2024-02-04T23:00:00.000+00:00",
          "number": "67",
          "summary": "Neue Updates von Gentoo aufgenommen"
        },
        {
          "date": "2024-02-27T23:00:00.000+00:00",
          "number": "68",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2024-03-18T23:00:00.000+00:00",
          "number": "69",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2024-03-27T23:00:00.000+00:00",
          "number": "70",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-04-24T22:00:00.000+00:00",
          "number": "71",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-06-03T22:00:00.000+00:00",
          "number": "72",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2024-06-04T22:00:00.000+00:00",
          "number": "73",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-06-13T22:00:00.000+00:00",
          "number": "74",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2024-06-26T22:00:00.000+00:00",
          "number": "75",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2024-07-23T22:00:00.000+00:00",
          "number": "76",
          "summary": "Neue Updates aufgenommen"
        }
      ],
      "status": "final",
      "version": "76"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Aruba ArubaOS",
            "product": {
              "name": "Aruba ArubaOS",
              "product_id": "T021926",
              "product_identification_helper": {
                "cpe": "cpe:/o:arubanetworks:arubaos:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Aruba ClearPass Policy Manager",
            "product": {
              "name": "Aruba ClearPass Policy Manager",
              "product_id": "T023403",
              "product_identification_helper": {
                "cpe": "cpe:/a:arubanetworks:clearpass_policy_manager:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Aruba EdgeConnect",
            "product": {
              "name": "Aruba EdgeConnect",
              "product_id": "T027755",
              "product_identification_helper": {
                "cpe": "cpe:/a:aruba:edgeconnect:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Aruba Switch",
            "product": {
              "name": "Aruba Switch",
              "product_id": "T016786",
              "product_identification_helper": {
                "cpe": "cpe:/h:arubanetworks:switch:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Aruba"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Dell Computer",
            "product": {
              "name": "Dell Computer",
              "product_id": "T006498",
              "product_identification_helper": {
                "cpe": "cpe:/o:dell:dell_computer:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c19.10",
                "product": {
                  "name": "Dell NetWorker \u003c19.10",
                  "product_id": "T032354",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:dell:networker:19.10"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "NetWorker"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Dell PowerEdge",
                "product": {
                  "name": "Dell PowerEdge",
                  "product_id": "T019535",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:dell:poweredge:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Dell PowerEdge",
                "product": {
                  "name": "Dell PowerEdge",
                  "product_id": "T033533",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:dell:poweredge:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "PowerEdge"
          }
        ],
        "category": "vendor",
        "name": "Dell"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "EMC Avamar",
            "product": {
              "name": "EMC Avamar",
              "product_id": "T014381",
              "product_identification_helper": {
                "cpe": "cpe:/a:emc:avamar:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "EMC"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "F5 BIG-IP",
            "product": {
              "name": "F5 BIG-IP",
              "product_id": "T001663",
              "product_identification_helper": {
                "cpe": "cpe:/a:f5:big-ip:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "F5"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "FreeBSD Project FreeBSD OS",
            "product": {
              "name": "FreeBSD Project FreeBSD OS",
              "product_id": "4035",
              "product_identification_helper": {
                "cpe": "cpe:/o:freebsd:freebsd:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "FreeBSD Project"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Gentoo Linux",
            "product": {
              "name": "Gentoo Linux",
              "product_id": "T012167",
              "product_identification_helper": {
                "cpe": "cpe:/o:gentoo:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Gentoo"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cv8.5",
                "product": {
                  "name": "HPE OneView \u003cv8.5",
                  "product_id": "T029950",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hp:oneview:v8.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cv6.60.05 LTS",
                "product": {
                  "name": "HPE OneView \u003cv6.60.05 LTS",
                  "product_id": "T029951",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hp:oneview:v6.60.05_lts"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OneView"
          }
        ],
        "category": "vendor",
        "name": "HPE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Hitachi Command Suite",
            "product": {
              "name": "Hitachi Command Suite",
              "product_id": "T010951",
              "product_identification_helper": {
                "cpe": "cpe:/a:hitachi:command_suite:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Hitachi Configuration Manager",
            "product": {
              "name": "Hitachi Configuration Manager",
              "product_id": "T020304",
              "product_identification_helper": {
                "cpe": "cpe:/a:hitachi:configuration_manager:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Hitachi"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Hitachi Energy AFS",
            "product": {
              "name": "Hitachi Energy AFS",
              "product_id": "T016942",
              "product_identification_helper": {
                "cpe": "cpe:/h:abb:afs:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Hitachi Energy RTU500",
            "product": {
              "name": "Hitachi Energy RTU500",
              "product_id": "T027844",
              "product_identification_helper": {
                "cpe": "cpe:/h:abb:rtu500:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "670",
                "product": {
                  "name": "Hitachi Energy Relion 670",
                  "product_id": "T016943",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:relion:670"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "650",
                "product": {
                  "name": "Hitachi Energy Relion 650",
                  "product_id": "T016944",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:relion:650"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "SAM600-IO",
                "product": {
                  "name": "Hitachi Energy Relion SAM600-IO",
                  "product_id": "T016945",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:relion:sam600-io"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Relion"
          }
        ],
        "category": "vendor",
        "name": "Hitachi Energy"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.1",
                "product": {
                  "name": "IBM AIX 7.1",
                  "product_id": "153340",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:ibm:aix:7.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.2",
                "product": {
                  "name": "IBM AIX 7.2",
                  "product_id": "434967",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:ibm:aix:7.2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.3",
                "product": {
                  "name": "IBM AIX 7.3",
                  "product_id": "T021486",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:ibm:aix:7.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "AIX"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "21.0.2",
                "product": {
                  "name": "IBM Business Automation Workflow 21.0.2",
                  "product_id": "1055431",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:21.0.2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "21.0.3",
                "product": {
                  "name": "IBM Business Automation Workflow 21.0.3",
                  "product_id": "1150328",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:21.0.3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "22.0.1",
                "product": {
                  "name": "IBM Business Automation Workflow 22.0.1",
                  "product_id": "1268578",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:22.0.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "18.0.0.0",
                "product": {
                  "name": "IBM Business Automation Workflow 18.0.0.0",
                  "product_id": "389078",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:18.0.0.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "18.0.0.1",
                "product": {
                  "name": "IBM Business Automation Workflow 18.0.0.1",
                  "product_id": "389079",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:18.0.0.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "18.0.0.2",
                "product": {
                  "name": "IBM Business Automation Workflow 18.0.0.2",
                  "product_id": "428468",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:18.0.0.2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "19.0.0.1",
                "product": {
                  "name": "IBM Business Automation Workflow 19.0.0.1",
                  "product_id": "433292",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:19.0.0.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "19.0.0.2",
                "product": {
                  "name": "IBM Business Automation Workflow 19.0.0.2",
                  "product_id": "672243",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:19.0.0.2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "19.0.0.3",
                "product": {
                  "name": "IBM Business Automation Workflow 19.0.0.3",
                  "product_id": "672244",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:19.0.0.3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "20.0.0.1",
                "product": {
                  "name": "IBM Business Automation Workflow 20.0.0.1",
                  "product_id": "867559",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:20.0.0.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "20.0.0.2",
                "product": {
                  "name": "IBM Business Automation Workflow 20.0.0.2",
                  "product_id": "867560",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:20.0.0.2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "21.0.3.1",
                "product": {
                  "name": "IBM Business Automation Workflow 21.0.3.1",
                  "product_id": "T025512",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:21.0.3.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "22.0.2",
                "product": {
                  "name": "IBM Business Automation Workflow 22.0.2",
                  "product_id": "T025770",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:22.0.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Business Automation Workflow"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.0.1.12",
                "product": {
                  "name": "IBM DataPower Gateway \u003c10.0.1.12",
                  "product_id": "T026646",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:10.0.1.12"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.5.0.4",
                "product": {
                  "name": "IBM DataPower Gateway \u003c10.5.0.4",
                  "product_id": "T026647",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:10.5.0.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c2018.4.1.26",
                "product": {
                  "name": "IBM DataPower Gateway \u003c2018.4.1.26",
                  "product_id": "T027562",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:2018.4.1.26"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.0.4.0sr3",
                "product": {
                  "name": "IBM DataPower Gateway \u003c10.0.4.0sr3",
                  "product_id": "T027563",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:10.0.4.0sr3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.0.1.12",
                "product": {
                  "name": "IBM DataPower Gateway \u003c10.0.1.12",
                  "product_id": "T027564",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:10.0.1.12"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "DataPower Gateway"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.7",
                "product": {
                  "name": "IBM InfoSphere Information Server 11.7",
                  "product_id": "444803",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:infosphere_information_server:11.7"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "InfoSphere Information Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.0.0.0-10.0.0.26",
                "product": {
                  "name": "IBM Integration Bus 10.0.0.0-10.0.0.26",
                  "product_id": "T023793",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:integration_bus:10.0.0.0_-_10.0.0.26"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "10.1",
                "product": {
                  "name": "IBM Integration Bus 10.1",
                  "product_id": "T026788",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:integration_bus:10.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Integration Bus"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "9.1 LTS",
                "product": {
                  "name": "IBM MQ 9.1 LTS",
                  "product_id": "T015789",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:9.1_lts"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8",
                "product": {
                  "name": "IBM MQ 8.0",
                  "product_id": "T015791",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:8.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "9.0 LTS",
                "product": {
                  "name": "IBM MQ 9.0 LTS",
                  "product_id": "T015792",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:9.0_lts"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "9.2 LTS",
                "product": {
                  "name": "IBM MQ 9.2 LTS",
                  "product_id": "T018186",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:9.2_lts"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "IBM MQ",
                "product": {
                  "name": "IBM MQ",
                  "product_id": "T021398",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "9.3 LTS",
                "product": {
                  "name": "IBM MQ 9.3 LTS",
                  "product_id": "T024689",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:9.3_lts"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "HPE NonStop 8.1.0",
                "product": {
                  "name": "IBM MQ HPE NonStop 8.1.0",
                  "product_id": "T026652",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:hpe_nonstop_8.1.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "MQ"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "v9",
                "product": {
                  "name": "IBM Power Hardware Management Console v9",
                  "product_id": "T021107",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:hardware_management_console:v9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v10",
                "product": {
                  "name": "IBM Power Hardware Management Console v10",
                  "product_id": "T023373",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:hardware_management_console:v10"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "DS8000",
                "product": {
                  "name": "IBM Power Hardware Management Console DS8000",
                  "product_id": "T028436",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:hardware_management_console:ds8000"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Power Hardware Management Console"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.5",
                "product": {
                  "name": "IBM QRadar SIEM 7.5",
                  "product_id": "T022954",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:qradar_siem:7.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.5.0 UP8",
                "product": {
                  "name": "IBM QRadar SIEM \u003c7.5.0 UP8",
                  "product_id": "T033681",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:qradar_siem:7.5.0_up8"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "QRadar SIEM"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c8.0.0.24",
                "product": {
                  "name": "IBM Rational Build Forge \u003c8.0.0.24",
                  "product_id": "T030689",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:rational_build_forge:8.0.0.24"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Rational Build Forge"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.1.0.5",
                "product": {
                  "name": "IBM Rational ClearCase \u003c9.1.0.5",
                  "product_id": "T030198",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:rational_clearcase:9.1.0.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.0.2.8",
                "product": {
                  "name": "IBM Rational ClearCase \u003c9.0.2.8",
                  "product_id": "T030199",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:rational_clearcase:9.0.2.8"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Rational ClearCase"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.0.3",
                "product": {
                  "name": "IBM Rational ClearQuest \u003c10.0.3",
                  "product_id": "T030177",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:rational_clearquest:10.0.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.0.2.8",
                "product": {
                  "name": "IBM Rational ClearQuest \u003c9.0.2.8",
                  "product_id": "T030204",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:rational_clearquest:9.0.2.8"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.1.0.5",
                "product": {
                  "name": "IBM Rational ClearQuest \u003c9.1.0.5",
                  "product_id": "T030211",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:rational_clearquest:9.1.0.5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Rational ClearQuest"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.0.X",
                "product": {
                  "name": "IBM Security Verify Access 10.0.X",
                  "product_id": "T026175",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:security_verify_access:10.0.x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "10.0.0.0-10.0.6.1",
                "product": {
                  "name": "IBM Security Verify Access 10.0.0.0-10.0.6.1",
                  "product_id": "T031895",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:security_verify_access:10.0.0.0_-_10.0.6.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Security Verify Access"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "plus 10.1",
                "product": {
                  "name": "IBM Spectrum Protect plus 10.1",
                  "product_id": "T015895",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_protect:plus_10.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "10.1.14",
                "product": {
                  "name": "IBM Spectrum Protect 10.1.14",
                  "product_id": "T026783",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_protect:10.1.14"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.1.17.2",
                "product": {
                  "name": "IBM Spectrum Protect \u003c8.1.17.2",
                  "product_id": "T026807",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_protect:8.1.17.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spectrum Protect"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.72 SU2",
                "product": {
                  "name": "LANCOM LCOS 10.72 SU2",
                  "product_id": "T026546",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:10.72_su2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "10.50 RU10",
                "product": {
                  "name": "LANCOM LCOS 10.50 RU10",
                  "product_id": "T026547",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:10.50_ru10"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "10.42 SU10",
                "product": {
                  "name": "LANCOM LCOS 10.42 SU10",
                  "product_id": "T026548",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:10.42_su10"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "FX 10.11",
                "product": {
                  "name": "LANCOM LCOS FX 10.11",
                  "product_id": "T026549",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:fx_10.11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "LX 6.10",
                "product": {
                  "name": "LANCOM LCOS LX 6.10",
                  "product_id": "T026550",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:lx_6.10"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "LX 5.38 SU1",
                "product": {
                  "name": "LANCOM LCOS LX 5.38 SU1",
                  "product_id": "T026551",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:lx_5.38_su1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "LX 5.36 SU2",
                "product": {
                  "name": "LANCOM LCOS LX 5.36 SU2",
                  "product_id": "T026552",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:lx_5.36_su2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "SX 4.20",
                "product": {
                  "name": "LANCOM LCOS SX 4.20",
                  "product_id": "T026553",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:sx_4.20"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "SX 5.20 RU3",
                "product": {
                  "name": "LANCOM LCOS SX 5.20 RU3",
                  "product_id": "T026554",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:lancom:lcos:sx_5.20_ru3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "LCOS"
          }
        ],
        "category": "vendor",
        "name": "LANCOM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.06.012",
                "product": {
                  "name": "Meinberg LANTIME 7.06.012",
                  "product_id": "T026735",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:meinberg:lantime:7.06.012"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.06.013",
                "product": {
                  "name": "Meinberg LANTIME \u003c7.06.013",
                  "product_id": "T027496",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:meinberg:lantime:7.06.013"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "LANTIME"
          }
        ],
        "category": "vendor",
        "name": "Meinberg"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "NetApp Data ONTAP",
            "product": {
              "name": "NetApp Data ONTAP",
              "product_id": "7654",
              "product_identification_helper": {
                "cpe": "cpe:/a:netapp:data_ontap:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "NetApp"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Open Source CentOS",
            "product": {
              "name": "Open Source CentOS",
              "product_id": "1727",
              "product_identification_helper": {
                "cpe": "cpe:/o:centos:centos:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.0.8",
                "product": {
                  "name": "Open Source OpenSSL \u003c3.0.8",
                  "product_id": "T026178",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openssl:openssl:3.0.8"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c1.1.1t",
                "product": {
                  "name": "Open Source OpenSSL \u003c1.1.1t",
                  "product_id": "T026179",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openssl:openssl:1.1.1t"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c1.0.2zg",
                "product": {
                  "name": "Open Source OpenSSL \u003c1.0.2zg",
                  "product_id": "T026180",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openssl:openssl:1.0.2zg"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenSSL"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3",
                "product": {
                  "name": "Oracle VM 3",
                  "product_id": "T019617",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:vm:3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "VM"
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "QNAP NAS",
            "product": {
              "name": "QNAP NAS",
              "product_id": "T017100",
              "product_identification_helper": {
                "cpe": "cpe:/h:qnap:nas:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "QNAP"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Multicluster Engine",
                "product": {
                  "name": "Red Hat Enterprise Linux Multicluster Engine",
                  "product_id": "T027598",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:multicluster_engine"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Container Platform \u003c4.11.43",
                "product": {
                  "name": "Red Hat OpenShift Container Platform \u003c4.11.43",
                  "product_id": "T028132",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform__4.11.43"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Container Platform \u003c4.13.4",
                "product": {
                  "name": "Red Hat OpenShift Container Platform \u003c4.13.4",
                  "product_id": "T028225",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform__4.13.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Container Platform \u003c4.12.22",
                "product": {
                  "name": "Red Hat OpenShift Container Platform \u003c4.12.22",
                  "product_id": "T028307",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform__4.12.22"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenShift"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1500",
                "product": {
                  "name": "Siemens SIMATIC S7 1500",
                  "product_id": "T019436",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:siemens:simatic_s7:1500"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Siemens SIMATIC S7",
                "product": {
                  "name": "Siemens SIMATIC S7",
                  "product_id": "T020086",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:siemens:simatic_s7:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC S7"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2024.2",
                "product": {
                  "name": "SolarWinds Platform \u003c2024.2",
                  "product_id": "T035149",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:solarwinds:orion_platform:2024.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Platform"
          }
        ],
        "category": "vendor",
        "name": "SolarWinds"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.2.1.7-49sv",
                "product": {
                  "name": "SonicWall SMA \u003c10.2.1.7-49sv",
                  "product_id": "897623",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:sonicwall:secure_mobile_access:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SMA"
          }
        ],
        "category": "vendor",
        "name": "SonicWall"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.5.0",
                "product": {
                  "name": "Tenable Security Nessus \u003c10.5.0",
                  "product_id": "T026604",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:tenable:nessus:10.5.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.15.9",
                "product": {
                  "name": "Tenable Security Nessus 8.15.9",
                  "product_id": "T026648",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:tenable:nessus:8.15.9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "10.4.3",
                "product": {
                  "name": "Tenable Security Nessus 10.4.3",
                  "product_id": "T026649",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:tenable:nessus:10.4.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Agent \u003c10.3.2",
                "product": {
                  "name": "Tenable Security Nessus Agent \u003c10.3.2",
                  "product_id": "T026696",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:tenable:nessus:agent__10.3.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Agent \u003c8.3.5",
                "product": {
                  "name": "Tenable Security Nessus Agent \u003c8.3.5",
                  "product_id": "T026697",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:tenable:nessus:agent__8.3.5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Nessus"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.2.1",
                "product": {
                  "name": "Tenable Security Nessus Network Monitor \u003c6.2.1",
                  "product_id": "T027665",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:tenable:nessus_network_monitor:6.2.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Nessus Network Monitor"
          }
        ],
        "category": "vendor",
        "name": "Tenable Security"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "v7",
                "product": {
                  "name": "Xerox FreeFlow Print Server v7",
                  "product_id": "T015631",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:xerox:freeflow_print_server:v7"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FreeFlow Print Server"
          }
        ],
        "category": "vendor",
        "name": "Xerox"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4203",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. Bei der X.509-Zertifikats\u00fcberpr\u00fcfung kann ein Lesepuffer\u00fcberlauf ausgel\u00f6st werden. Ein privilegierter Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2022-4203"
    },
    {
      "cve": "CVE-2022-4304",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. In der RSA-Entschl\u00fcsselungsimplementierung von OpenSSL gibt es einen zeitbasierten Seitenkanal. Ein entfernter, anonymer Angreifer kann diese Schwachstelle unter bestimmten Voraussetzungen ausnutzen, um Chiffretext \u00fcber ein Netzwerk wiederherzustellen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2022-4304"
    },
    {
      "cve": "CVE-2022-4450",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. In der \"PEM_read_bio_ex\" Funktion besteht ein Double-free Problem. Ein entfernter, anonymer Angreifer kann diese Schwachstelle durch das Senden einer speziell bearbeiteten PEM-Datei ausnutzen, um einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2022-4450"
    },
    {
      "cve": "CVE-2023-0215",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. In der \"BIO_new_NDEF\" Funktion besteht ein use-after-free Problem. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2023-0215"
    },
    {
      "cve": "CVE-2023-0216",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. Beim Lesen kann eine ung\u00fcltige Zeiger-Dereferenz ausgel\u00f6st werden, wenn eine Anwendung versucht, fehlerhafte PKCS7-Daten mit den Funktionen \"d2i_PKCS7()\", \"d2i_PKCS7_bio()\" oder \"d2i_PKCS7_fp()\" zu laden. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Servie zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2023-0216"
    },
    {
      "cve": "CVE-2023-0217",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. Beim Lesen kann eine ung\u00fcltige Zeiger-Dereferenz ausgel\u00f6st werden, wenn eine Anwendung versucht, einen missgebildeten \u00f6ffentlichen DSA-Schl\u00fcssel mit der Funktion \"EVP_PKEY_public_check()\" zu \u00fcberpr\u00fcfen. Ein entfenrter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2023-0217"
    },
    {
      "cve": "CVE-2023-0286",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. Wenn OpenSSL X.400 Adressen innerhalb eines \"X.509 GeneralName\" verarbeitet weren kommt es zu einem Type Confusion Problem. Ein Angreifer kann diese Schwachstelle ausnutzen, um Informationen offenzulegen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2023-0286"
    },
    {
      "cve": "CVE-2023-0401",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSL. Wenn Signaturen auf PKCS7-signierten oder \"signedAndEnveloped\" Daten \u00fcberpr\u00fcft werden kommt es unter bestimmten Umst\u00e4nden zu einer NULL-Zeiger Dereferenzierung. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031895",
          "T030204",
          "T010951",
          "T030689",
          "T019535",
          "T024689",
          "433292",
          "398363",
          "T025770",
          "T020086",
          "T028132",
          "T030211",
          "T030177",
          "1268578",
          "389079",
          "T033681",
          "T012167",
          "389078",
          "897623",
          "T032354",
          "T015792",
          "T015791",
          "T022954",
          "2951",
          "T021107",
          "T023403",
          "T027844",
          "T027564",
          "T027562",
          "T027563",
          "T033533",
          "672243",
          "672244",
          "T026604",
          "T025512",
          "T021398",
          "T028225",
          "T029951",
          "T027496",
          "T029950",
          "T026175",
          "T016945",
          "T016944",
          "T016943",
          "T016942",
          "T016786",
          "T017100",
          "T000126",
          "T026735",
          "T026697",
          "T027665",
          "T026696",
          "T006498",
          "T021926",
          "T004914",
          "T026548",
          "T026547",
          "T026549",
          "T023793",
          "T027755",
          "T019617",
          "T026788",
          "T026546",
          "T026783",
          "T027598",
          "153340",
          "867559",
          "T035149",
          "434967",
          "7654",
          "428468",
          "T015631",
          "1150328",
          "T014381",
          "T002207",
          "867560",
          "444803",
          "T026554",
          "T026551",
          "T026550",
          "T026553",
          "T026552",
          "67646",
          "4035",
          "T015789",
          "T018186",
          "1055431",
          "T026807",
          "T019436",
          "T026648",
          "T026649",
          "T020304",
          "T026646",
          "T028307",
          "T026647",
          "T001663",
          "T023373",
          "T030199",
          "T015895",
          "T030198",
          "T028436",
          "1727",
          "T021486",
          "T026652"
        ]
      },
      "release_date": "2023-02-07T23:00:00Z",
      "title": "CVE-2023-0401"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Oracle heeft kwetsbaarheden verholpen in Analytics producten.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n- Denial-of-Service\n- Manipuleren van data\n- Uitvoer van willekeurige code (Gebruikersrechten)\n- Uitvoer van willekeurige code (Administratorrechten)\n- Toegang tot gevoelige gegevens",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Unchecked Input for Loop Condition",
        "title": "CWE-606"
      },
      {
        "category": "general",
        "text": "Improper Check for Unusual or Exceptional Conditions",
        "title": "CWE-754"
      },
      {
        "category": "general",
        "text": "Insufficient Verification of Data Authenticity",
        "title": "CWE-345"
      },
      {
        "category": "general",
        "text": "Missing Cryptographic Step",
        "title": "CWE-325"
      },
      {
        "category": "general",
        "text": "Improper Resource Shutdown or Release",
        "title": "CWE-404"
      },
      {
        "category": "general",
        "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
        "title": "CWE-119"
      },
      {
        "category": "general",
        "text": "Inefficient Regular Expression Complexity",
        "title": "CWE-1333"
      },
      {
        "category": "general",
        "text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
        "title": "CWE-1321"
      },
      {
        "category": "general",
        "text": "NULL Pointer Dereference",
        "title": "CWE-476"
      },
      {
        "category": "general",
        "text": "Uncontrolled Resource Consumption",
        "title": "CWE-400"
      },
      {
        "category": "general",
        "text": "Allocation of Resources Without Limits or Throttling",
        "title": "CWE-770"
      },
      {
        "category": "general",
        "text": "Server-Side Request Forgery (SSRF)",
        "title": "CWE-918"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Write",
        "title": "CWE-787"
      },
      {
        "category": "general",
        "text": "Heap-based Buffer Overflow",
        "title": "CWE-122"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
        "title": "CWE-89"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference - cveprojectv5; hkcert; nvd; oracle; redhat",
        "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Oracle Analytics",
    "tracking": {
      "current_release_date": "2024-10-17T13:19:50.583299Z",
      "id": "NCSC-2024-0418",
      "initial_release_date": "2024-10-17T13:19:50.583299Z",
      "revision_history": [
        {
          "date": "2024-10-17T13:19:50.583299Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-1503573",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_analytics_server___12.2.1.4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-765388",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_analytics_server___5.9.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764727",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_analytics_server___6.4.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764729",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_analytics_server___7.0.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-765383",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_bi_platform_security___12.2.1.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-765385",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_bi_platform_security___12.2.1.4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-765389",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_bi_platform_security___5.9.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764725",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_presentation_services___12.2.1.4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764728",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_presentation_services___6.4.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764730",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_presentation_services___7.0.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764726",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_service_administration_ui___12.2.1.4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-765386",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_storage_service_integration___12.2.1.4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-765384",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764234",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:12.2.1.4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-765387",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:5.5.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764929",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:5.9.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764778",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:5.9.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764930",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:6.4.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764235",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:6.4.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764236",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:7.0.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-1503574",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:7.6.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence",
            "product": {
              "name": "business_intelligence",
              "product_id": "CSAFPID-376906",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:*:enterprise:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence",
            "product": {
              "name": "business_intelligence",
              "product_id": "CSAFPID-135812",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence",
            "product": {
              "name": "business_intelligence",
              "product_id": "CSAFPID-220360",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:*:enterprise:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence",
            "product": {
              "name": "business_intelligence",
              "product_id": "CSAFPID-135810",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence",
            "product": {
              "name": "business_intelligence",
              "product_id": "CSAFPID-179569",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence",
            "product": {
              "name": "business_intelligence",
              "product_id": "CSAFPID-257324",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence:7.0.0.0.0:*:*:*:enterprise:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence",
            "product": {
              "name": "business_intelligence",
              "product_id": "CSAFPID-1650736",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence:7.6.0.0.0:*:*:*:enterprise:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bi_publisher",
            "product": {
              "name": "bi_publisher",
              "product_id": "CSAFPID-9197",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:bi_publisher:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bi_publisher",
            "product": {
              "name": "bi_publisher",
              "product_id": "CSAFPID-9493",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bi_publisher",
            "product": {
              "name": "bi_publisher",
              "product_id": "CSAFPID-220546",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:bi_publisher:5.9.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bi_publisher",
            "product": {
              "name": "bi_publisher",
              "product_id": "CSAFPID-228391",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:bi_publisher:5.9.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bi_publisher",
            "product": {
              "name": "bi_publisher",
              "product_id": "CSAFPID-220545",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:bi_publisher:6.4.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bi_publisher",
            "product": {
              "name": "bi_publisher",
              "product_id": "CSAFPID-220560",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:bi_publisher:7.0.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bi_publisher",
            "product": {
              "name": "bi_publisher",
              "product_id": "CSAFPID-1673195",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:bi_publisher:7.6.0.0.0:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "oracle"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-23305",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
          "title": "CWE-89"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-135810",
          "CSAFPID-220545",
          "CSAFPID-220560",
          "CSAFPID-764725",
          "CSAFPID-764726",
          "CSAFPID-764234",
          "CSAFPID-764727",
          "CSAFPID-764728",
          "CSAFPID-764235",
          "CSAFPID-764729",
          "CSAFPID-764730",
          "CSAFPID-764236",
          "CSAFPID-9493",
          "CSAFPID-764778",
          "CSAFPID-228391",
          "CSAFPID-220546",
          "CSAFPID-9197",
          "CSAFPID-764929",
          "CSAFPID-764930",
          "CSAFPID-765383",
          "CSAFPID-765384",
          "CSAFPID-765385",
          "CSAFPID-765386",
          "CSAFPID-765387",
          "CSAFPID-765388",
          "CSAFPID-765389",
          "CSAFPID-257324"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2022-23305",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-23305.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-135810",
            "CSAFPID-220545",
            "CSAFPID-220560",
            "CSAFPID-764725",
            "CSAFPID-764726",
            "CSAFPID-764234",
            "CSAFPID-764727",
            "CSAFPID-764728",
            "CSAFPID-764235",
            "CSAFPID-764729",
            "CSAFPID-764730",
            "CSAFPID-764236",
            "CSAFPID-9493",
            "CSAFPID-764778",
            "CSAFPID-228391",
            "CSAFPID-220546",
            "CSAFPID-9197",
            "CSAFPID-764929",
            "CSAFPID-764930",
            "CSAFPID-765383",
            "CSAFPID-765384",
            "CSAFPID-765385",
            "CSAFPID-765386",
            "CSAFPID-765387",
            "CSAFPID-765388",
            "CSAFPID-765389",
            "CSAFPID-257324"
          ]
        }
      ],
      "title": "CVE-2022-23305"
    },
    {
      "cve": "CVE-2023-0401",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1650736",
          "CSAFPID-135810",
          "CSAFPID-220545",
          "CSAFPID-220560",
          "CSAFPID-764234",
          "CSAFPID-764235",
          "CSAFPID-764236",
          "CSAFPID-764725",
          "CSAFPID-764726",
          "CSAFPID-764727",
          "CSAFPID-764728",
          "CSAFPID-764729",
          "CSAFPID-764730"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-0401",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-0401.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1650736",
            "CSAFPID-135810",
            "CSAFPID-220545",
            "CSAFPID-220560",
            "CSAFPID-764234",
            "CSAFPID-764235",
            "CSAFPID-764236",
            "CSAFPID-764725",
            "CSAFPID-764726",
            "CSAFPID-764727",
            "CSAFPID-764728",
            "CSAFPID-764729",
            "CSAFPID-764730"
          ]
        }
      ],
      "title": "CVE-2023-0401"
    },
    {
      "cve": "CVE-2023-5678",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Check for Unusual or Exceptional Conditions",
          "title": "CWE-754"
        },
        {
          "category": "other",
          "text": "Missing Cryptographic Step",
          "title": "CWE-325"
        },
        {
          "category": "other",
          "text": "Unchecked Input for Loop Condition",
          "title": "CWE-606"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1650736",
          "CSAFPID-257324",
          "CSAFPID-9493",
          "CSAFPID-220560",
          "CSAFPID-764234",
          "CSAFPID-764236",
          "CSAFPID-1503573",
          "CSAFPID-765385",
          "CSAFPID-1503574"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-5678",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5678.json"
        }
      ],
      "title": "CVE-2023-5678"
    },
    {
      "cve": "CVE-2023-35116",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-9493",
          "CSAFPID-257324",
          "CSAFPID-220545",
          "CSAFPID-220560",
          "CSAFPID-764234",
          "CSAFPID-764235",
          "CSAFPID-764236",
          "CSAFPID-1503573",
          "CSAFPID-765385",
          "CSAFPID-1503574"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-35116",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-35116.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-9493",
            "CSAFPID-257324",
            "CSAFPID-220545",
            "CSAFPID-220560",
            "CSAFPID-764234",
            "CSAFPID-764235",
            "CSAFPID-764236",
            "CSAFPID-1503573",
            "CSAFPID-765385",
            "CSAFPID-1503574"
          ]
        }
      ],
      "title": "CVE-2023-35116"
    },
    {
      "cve": "CVE-2023-38545",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Heap-based Buffer Overflow",
          "title": "CWE-122"
        },
        {
          "category": "other",
          "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
          "title": "CWE-119"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-9493",
          "CSAFPID-220545",
          "CSAFPID-220560",
          "CSAFPID-764234",
          "CSAFPID-764235",
          "CSAFPID-764236",
          "CSAFPID-1650736",
          "CSAFPID-257324",
          "CSAFPID-135810"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-38545",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-38545.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-9493",
            "CSAFPID-220545",
            "CSAFPID-220560",
            "CSAFPID-764234",
            "CSAFPID-764235",
            "CSAFPID-764236",
            "CSAFPID-1650736",
            "CSAFPID-257324",
            "CSAFPID-135810"
          ]
        }
      ],
      "title": "CVE-2023-38545"
    },
    {
      "cve": "CVE-2024-21195",
      "product_status": {
        "known_affected": [
          "CSAFPID-9493",
          "CSAFPID-1673195",
          "CSAFPID-220560"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21195",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21195.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-9493",
            "CSAFPID-1673195",
            "CSAFPID-220560"
          ]
        }
      ],
      "title": "CVE-2024-21195"
    },
    {
      "cve": "CVE-2024-21254",
      "product_status": {
        "known_affected": [
          "CSAFPID-9493",
          "CSAFPID-220560",
          "CSAFPID-1673195"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21254",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21254.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-9493",
            "CSAFPID-220560",
            "CSAFPID-1673195"
          ]
        }
      ],
      "title": "CVE-2024-21254"
    },
    {
      "cve": "CVE-2024-26308",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-257324",
          "CSAFPID-9493",
          "CSAFPID-220560",
          "CSAFPID-764234",
          "CSAFPID-764236",
          "CSAFPID-1503573",
          "CSAFPID-765385",
          "CSAFPID-1503574"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-26308",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-26308.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-257324",
            "CSAFPID-9493",
            "CSAFPID-220560",
            "CSAFPID-764234",
            "CSAFPID-764236",
            "CSAFPID-1503573",
            "CSAFPID-765385",
            "CSAFPID-1503574"
          ]
        }
      ],
      "title": "CVE-2024-26308"
    },
    {
      "cve": "CVE-2024-29133",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-257324",
          "CSAFPID-1503573",
          "CSAFPID-765385",
          "CSAFPID-764234",
          "CSAFPID-764236",
          "CSAFPID-1503574"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-29133",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-29133.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-257324",
            "CSAFPID-1503573",
            "CSAFPID-765385",
            "CSAFPID-764234",
            "CSAFPID-764236",
            "CSAFPID-1503574"
          ]
        }
      ],
      "title": "CVE-2024-29133"
    },
    {
      "cve": "CVE-2024-29736",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Server-Side Request Forgery (SSRF)",
          "title": "CWE-918"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-220560",
          "CSAFPID-1673195"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-29736",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-29736.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-220560",
            "CSAFPID-1673195"
          ]
        }
      ],
      "title": "CVE-2024-29736"
    },
    {
      "cve": "CVE-2024-38809",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "notes": [
        {
          "category": "other",
          "text": "Inefficient Regular Expression Complexity",
          "title": "CWE-1333"
        },
        {
          "category": "other",
          "text": "Improper Resource Shutdown or Release",
          "title": "CWE-404"
        },
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-220560",
          "CSAFPID-1673195"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38809",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38809.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-220560",
            "CSAFPID-1673195"
          ]
        }
      ],
      "title": "CVE-2024-38809"
    },
    {
      "cve": "CVE-2024-38999",
      "cwe": {
        "id": "CWE-1321",
        "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
          "title": "CWE-1321"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-135810",
          "CSAFPID-1650736",
          "CSAFPID-257324"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38999",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38999.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-135810",
            "CSAFPID-1650736",
            "CSAFPID-257324"
          ]
        }
      ],
      "title": "CVE-2024-38999"
    },
    {
      "cve": "CVE-2024-39689",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "notes": [
        {
          "category": "other",
          "text": "Insufficient Verification of Data Authenticity",
          "title": "CWE-345"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1650736"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39689",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39689.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1650736"
          ]
        }
      ],
      "title": "CVE-2024-39689"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Oracle heeft kwetsbaarheden verholpen in Analytics producten.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n- Denial-of-Service\n- Manipuleren van data\n- Uitvoer van willekeurige code (Gebruikersrechten)\n- Uitvoer van willekeurige code (Administratorrechten)\n- Toegang tot gevoelige gegevens",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Unchecked Input for Loop Condition",
        "title": "CWE-606"
      },
      {
        "category": "general",
        "text": "Improper Check for Unusual or Exceptional Conditions",
        "title": "CWE-754"
      },
      {
        "category": "general",
        "text": "Insufficient Verification of Data Authenticity",
        "title": "CWE-345"
      },
      {
        "category": "general",
        "text": "Missing Cryptographic Step",
        "title": "CWE-325"
      },
      {
        "category": "general",
        "text": "Improper Resource Shutdown or Release",
        "title": "CWE-404"
      },
      {
        "category": "general",
        "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
        "title": "CWE-119"
      },
      {
        "category": "general",
        "text": "Inefficient Regular Expression Complexity",
        "title": "CWE-1333"
      },
      {
        "category": "general",
        "text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
        "title": "CWE-1321"
      },
      {
        "category": "general",
        "text": "NULL Pointer Dereference",
        "title": "CWE-476"
      },
      {
        "category": "general",
        "text": "Uncontrolled Resource Consumption",
        "title": "CWE-400"
      },
      {
        "category": "general",
        "text": "Allocation of Resources Without Limits or Throttling",
        "title": "CWE-770"
      },
      {
        "category": "general",
        "text": "Server-Side Request Forgery (SSRF)",
        "title": "CWE-918"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Write",
        "title": "CWE-787"
      },
      {
        "category": "general",
        "text": "Heap-based Buffer Overflow",
        "title": "CWE-122"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
        "title": "CWE-89"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference - cveprojectv5; hkcert; nvd; oracle; redhat",
        "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Oracle Analytics",
    "tracking": {
      "current_release_date": "2024-10-17T13:19:50.583299Z",
      "id": "NCSC-2024-0418",
      "initial_release_date": "2024-10-17T13:19:50.583299Z",
      "revision_history": [
        {
          "date": "2024-10-17T13:19:50.583299Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-1503573",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_analytics_server___12.2.1.4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-765388",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_analytics_server___5.9.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764727",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_analytics_server___6.4.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764729",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_analytics_server___7.0.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-765383",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_bi_platform_security___12.2.1.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-765385",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_bi_platform_security___12.2.1.4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-765389",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_bi_platform_security___5.9.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764725",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_presentation_services___12.2.1.4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764728",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_presentation_services___6.4.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764730",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_presentation_services___7.0.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764726",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_service_administration_ui___12.2.1.4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-765386",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_storage_service_integration___12.2.1.4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-765384",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764234",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:12.2.1.4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-765387",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:5.5.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764929",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:5.9.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764778",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:5.9.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764930",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:6.4.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764235",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:6.4.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-764236",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:7.0.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence_enterprise_edition",
            "product": {
              "name": "business_intelligence_enterprise_edition",
              "product_id": "CSAFPID-1503574",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:7.6.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence",
            "product": {
              "name": "business_intelligence",
              "product_id": "CSAFPID-376906",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:*:enterprise:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence",
            "product": {
              "name": "business_intelligence",
              "product_id": "CSAFPID-135812",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence",
            "product": {
              "name": "business_intelligence",
              "product_id": "CSAFPID-220360",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:*:enterprise:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence",
            "product": {
              "name": "business_intelligence",
              "product_id": "CSAFPID-135810",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence",
            "product": {
              "name": "business_intelligence",
              "product_id": "CSAFPID-179569",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence",
            "product": {
              "name": "business_intelligence",
              "product_id": "CSAFPID-257324",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence:7.0.0.0.0:*:*:*:enterprise:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "business_intelligence",
            "product": {
              "name": "business_intelligence",
              "product_id": "CSAFPID-1650736",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:business_intelligence:7.6.0.0.0:*:*:*:enterprise:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bi_publisher",
            "product": {
              "name": "bi_publisher",
              "product_id": "CSAFPID-9197",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:bi_publisher:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bi_publisher",
            "product": {
              "name": "bi_publisher",
              "product_id": "CSAFPID-9493",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bi_publisher",
            "product": {
              "name": "bi_publisher",
              "product_id": "CSAFPID-220546",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:bi_publisher:5.9.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bi_publisher",
            "product": {
              "name": "bi_publisher",
              "product_id": "CSAFPID-228391",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:bi_publisher:5.9.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bi_publisher",
            "product": {
              "name": "bi_publisher",
              "product_id": "CSAFPID-220545",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:bi_publisher:6.4.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bi_publisher",
            "product": {
              "name": "bi_publisher",
              "product_id": "CSAFPID-220560",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:bi_publisher:7.0.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bi_publisher",
            "product": {
              "name": "bi_publisher",
              "product_id": "CSAFPID-1673195",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:bi_publisher:7.6.0.0.0:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "oracle"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-23305",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
          "title": "CWE-89"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-135810",
          "CSAFPID-220545",
          "CSAFPID-220560",
          "CSAFPID-764725",
          "CSAFPID-764726",
          "CSAFPID-764234",
          "CSAFPID-764727",
          "CSAFPID-764728",
          "CSAFPID-764235",
          "CSAFPID-764729",
          "CSAFPID-764730",
          "CSAFPID-764236",
          "CSAFPID-9493",
          "CSAFPID-764778",
          "CSAFPID-228391",
          "CSAFPID-220546",
          "CSAFPID-9197",
          "CSAFPID-764929",
          "CSAFPID-764930",
          "CSAFPID-765383",
          "CSAFPID-765384",
          "CSAFPID-765385",
          "CSAFPID-765386",
          "CSAFPID-765387",
          "CSAFPID-765388",
          "CSAFPID-765389",
          "CSAFPID-257324"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2022-23305",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-23305.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-135810",
            "CSAFPID-220545",
            "CSAFPID-220560",
            "CSAFPID-764725",
            "CSAFPID-764726",
            "CSAFPID-764234",
            "CSAFPID-764727",
            "CSAFPID-764728",
            "CSAFPID-764235",
            "CSAFPID-764729",
            "CSAFPID-764730",
            "CSAFPID-764236",
            "CSAFPID-9493",
            "CSAFPID-764778",
            "CSAFPID-228391",
            "CSAFPID-220546",
            "CSAFPID-9197",
            "CSAFPID-764929",
            "CSAFPID-764930",
            "CSAFPID-765383",
            "CSAFPID-765384",
            "CSAFPID-765385",
            "CSAFPID-765386",
            "CSAFPID-765387",
            "CSAFPID-765388",
            "CSAFPID-765389",
            "CSAFPID-257324"
          ]
        }
      ],
      "title": "CVE-2022-23305"
    },
    {
      "cve": "CVE-2023-0401",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1650736",
          "CSAFPID-135810",
          "CSAFPID-220545",
          "CSAFPID-220560",
          "CSAFPID-764234",
          "CSAFPID-764235",
          "CSAFPID-764236",
          "CSAFPID-764725",
          "CSAFPID-764726",
          "CSAFPID-764727",
          "CSAFPID-764728",
          "CSAFPID-764729",
          "CSAFPID-764730"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-0401",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-0401.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1650736",
            "CSAFPID-135810",
            "CSAFPID-220545",
            "CSAFPID-220560",
            "CSAFPID-764234",
            "CSAFPID-764235",
            "CSAFPID-764236",
            "CSAFPID-764725",
            "CSAFPID-764726",
            "CSAFPID-764727",
            "CSAFPID-764728",
            "CSAFPID-764729",
            "CSAFPID-764730"
          ]
        }
      ],
      "title": "CVE-2023-0401"
    },
    {
      "cve": "CVE-2023-5678",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Check for Unusual or Exceptional Conditions",
          "title": "CWE-754"
        },
        {
          "category": "other",
          "text": "Missing Cryptographic Step",
          "title": "CWE-325"
        },
        {
          "category": "other",
          "text": "Unchecked Input for Loop Condition",
          "title": "CWE-606"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1650736",
          "CSAFPID-257324",
          "CSAFPID-9493",
          "CSAFPID-220560",
          "CSAFPID-764234",
          "CSAFPID-764236",
          "CSAFPID-1503573",
          "CSAFPID-765385",
          "CSAFPID-1503574"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-5678",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5678.json"
        }
      ],
      "title": "CVE-2023-5678"
    },
    {
      "cve": "CVE-2023-35116",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-9493",
          "CSAFPID-257324",
          "CSAFPID-220545",
          "CSAFPID-220560",
          "CSAFPID-764234",
          "CSAFPID-764235",
          "CSAFPID-764236",
          "CSAFPID-1503573",
          "CSAFPID-765385",
          "CSAFPID-1503574"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-35116",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-35116.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-9493",
            "CSAFPID-257324",
            "CSAFPID-220545",
            "CSAFPID-220560",
            "CSAFPID-764234",
            "CSAFPID-764235",
            "CSAFPID-764236",
            "CSAFPID-1503573",
            "CSAFPID-765385",
            "CSAFPID-1503574"
          ]
        }
      ],
      "title": "CVE-2023-35116"
    },
    {
      "cve": "CVE-2023-38545",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Heap-based Buffer Overflow",
          "title": "CWE-122"
        },
        {
          "category": "other",
          "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
          "title": "CWE-119"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-9493",
          "CSAFPID-220545",
          "CSAFPID-220560",
          "CSAFPID-764234",
          "CSAFPID-764235",
          "CSAFPID-764236",
          "CSAFPID-1650736",
          "CSAFPID-257324",
          "CSAFPID-135810"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-38545",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-38545.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-9493",
            "CSAFPID-220545",
            "CSAFPID-220560",
            "CSAFPID-764234",
            "CSAFPID-764235",
            "CSAFPID-764236",
            "CSAFPID-1650736",
            "CSAFPID-257324",
            "CSAFPID-135810"
          ]
        }
      ],
      "title": "CVE-2023-38545"
    },
    {
      "cve": "CVE-2024-21195",
      "product_status": {
        "known_affected": [
          "CSAFPID-9493",
          "CSAFPID-1673195",
          "CSAFPID-220560"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21195",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21195.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-9493",
            "CSAFPID-1673195",
            "CSAFPID-220560"
          ]
        }
      ],
      "title": "CVE-2024-21195"
    },
    {
      "cve": "CVE-2024-21254",
      "product_status": {
        "known_affected": [
          "CSAFPID-9493",
          "CSAFPID-220560",
          "CSAFPID-1673195"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21254",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21254.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-9493",
            "CSAFPID-220560",
            "CSAFPID-1673195"
          ]
        }
      ],
      "title": "CVE-2024-21254"
    },
    {
      "cve": "CVE-2024-26308",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-257324",
          "CSAFPID-9493",
          "CSAFPID-220560",
          "CSAFPID-764234",
          "CSAFPID-764236",
          "CSAFPID-1503573",
          "CSAFPID-765385",
          "CSAFPID-1503574"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-26308",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-26308.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-257324",
            "CSAFPID-9493",
            "CSAFPID-220560",
            "CSAFPID-764234",
            "CSAFPID-764236",
            "CSAFPID-1503573",
            "CSAFPID-765385",
            "CSAFPID-1503574"
          ]
        }
      ],
      "title": "CVE-2024-26308"
    },
    {
      "cve": "CVE-2024-29133",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-257324",
          "CSAFPID-1503573",
          "CSAFPID-765385",
          "CSAFPID-764234",
          "CSAFPID-764236",
          "CSAFPID-1503574"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-29133",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-29133.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-257324",
            "CSAFPID-1503573",
            "CSAFPID-765385",
            "CSAFPID-764234",
            "CSAFPID-764236",
            "CSAFPID-1503574"
          ]
        }
      ],
      "title": "CVE-2024-29133"
    },
    {
      "cve": "CVE-2024-29736",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Server-Side Request Forgery (SSRF)",
          "title": "CWE-918"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-220560",
          "CSAFPID-1673195"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-29736",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-29736.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-220560",
            "CSAFPID-1673195"
          ]
        }
      ],
      "title": "CVE-2024-29736"
    },
    {
      "cve": "CVE-2024-38809",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "notes": [
        {
          "category": "other",
          "text": "Inefficient Regular Expression Complexity",
          "title": "CWE-1333"
        },
        {
          "category": "other",
          "text": "Improper Resource Shutdown or Release",
          "title": "CWE-404"
        },
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-220560",
          "CSAFPID-1673195"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38809",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38809.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-220560",
            "CSAFPID-1673195"
          ]
        }
      ],
      "title": "CVE-2024-38809"
    },
    {
      "cve": "CVE-2024-38999",
      "cwe": {
        "id": "CWE-1321",
        "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
          "title": "CWE-1321"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-135810",
          "CSAFPID-1650736",
          "CSAFPID-257324"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38999",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38999.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-135810",
            "CSAFPID-1650736",
            "CSAFPID-257324"
          ]
        }
      ],
      "title": "CVE-2024-38999"
    },
    {
      "cve": "CVE-2024-39689",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "notes": [
        {
          "category": "other",
          "text": "Insufficient Verification of Data Authenticity",
          "title": "CWE-345"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1650736"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39689",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39689.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1650736"
          ]
        }
      ],
      "title": "CVE-2024-39689"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2023-0401",
    "id": "GSD-2023-0401",
    "references": [
      "https://access.redhat.com/errata/RHSA-2023:0946",
      "https://www.suse.com/security/cve/CVE-2023-0401.html",
      "https://ubuntu.com/security/CVE-2023-0401"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-0401"
      ],
      "details": "A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.",
      "id": "GSD-2023-0401",
      "modified": "2023-12-13T01:20:22.609446Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "openssl-security@openssl.org",
        "ID": "CVE-2023-0401",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "OpenSSL",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "3.0.0",
                          "version_value": "3.0.8"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "OpenSSL"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Hubert Kario (Red Hat)"
        },
        {
          "lang": "en",
          "value": "Dmitry Belyavsky (Red Hat)"
        },
        {
          "lang": "en",
          "value": "Tom\u00e1\u0161 Mr\u00e1z"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A NULL pointer can be dereferenced when signatures are being\nverified on PKCS7 signed or signedAndEnveloped data. In case the hash\nalgorithm used for the signature is known to the OpenSSL library but\nthe implementation of the hash algorithm is not available the digest\ninitialization will fail. There is a missing check for the return\nvalue from the initialization function which later leads to invalid\nusage of the digest API most likely leading to a crash.\n\nThe unavailability of an algorithm can be caused by using FIPS\nenabled configuration of providers or more commonly by not loading\nthe legacy provider.\n\nPKCS7 data is processed by the SMIME library calls and also by the\ntime stamp (TS) library calls. The TLS implementation in OpenSSL does\nnot call these functions however third party applications would be\naffected if they call these functions to verify signatures on untrusted\ndata.\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "NULL pointer deference"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.openssl.org/news/secadv/20230207.txt",
            "refsource": "MISC",
            "url": "https://www.openssl.org/news/secadv/20230207.txt"
          },
          {
            "name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=d3b6dfd70db844c4499bec6ad6601623a565e674",
            "refsource": "MISC",
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=d3b6dfd70db844c4499bec6ad6601623a565e674"
          },
          {
            "name": "https://security.gentoo.org/glsa/202402-08",
            "refsource": "MISC",
            "url": "https://security.gentoo.org/glsa/202402-08"
          }
        ]
      },
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=3.0.0 \u003c=3.0.7",
          "affected_versions": "All versions starting from 3.0.0 up to 3.0.7",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-476",
            "CWE-937"
          ],
          "date": "2023-07-19",
          "description": "A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.",
          "fixed_versions": [
            "3.0.8"
          ],
          "identifier": "CVE-2023-0401",
          "identifiers": [
            "CVE-2023-0401"
          ],
          "not_impacted": "All versions before 3.0.0, all versions after 3.0.7",
          "package_slug": "conan/openssl",
          "pubdate": "2023-02-08",
          "solution": "Upgrade to version 3.0.8 or above.",
          "title": "NULL Pointer Dereference",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2023-0401",
            "https://www.openssl.org/news/secadv/20230207.txt"
          ],
          "uuid": "eb9082c4-d518-4487-8994-e78dd3cb440b"
        }
      ]
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26EF8A48-B8E5-4D4D-8054-445D65171EAC",
                    "versionEndIncluding": "3.0.7",
                    "versionStartIncluding": "3.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "62A933C5-C56E-485C-AD49-3B6A2C329131",
                    "versionEndExcluding": "3.3.3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "A NULL pointer can be dereferenced when signatures are being\nverified on PKCS7 signed or signedAndEnveloped data. In case the hash\nalgorithm used for the signature is known to the OpenSSL library but\nthe implementation of the hash algorithm is not available the digest\ninitialization will fail. There is a missing check for the return\nvalue from the initialization function which later leads to invalid\nusage of the digest API most likely leading to a crash.\n\nThe unavailability of an algorithm can be caused by using FIPS\nenabled configuration of providers or more commonly by not loading\nthe legacy provider.\n\nPKCS7 data is processed by the SMIME library calls and also by the\ntime stamp (TS) library calls. The TLS implementation in OpenSSL does\nnot call these functions however third party applications would be\naffected if they call these functions to verify signatures on untrusted\ndata.\n\n"
          }
        ],
        "id": "CVE-2023-0401",
        "lastModified": "2024-02-04T09:15:09.223",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2023-02-08T20:15:24.323",
        "references": [
          {
            "source": "openssl-security@openssl.org",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=d3b6dfd70db844c4499bec6ad6601623a565e674"
          },
          {
            "source": "openssl-security@openssl.org",
            "url": "https://security.gentoo.org/glsa/202402-08"
          },
          {
            "source": "openssl-security@openssl.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.openssl.org/news/secadv/20230207.txt"
          }
        ],
        "sourceIdentifier": "openssl-security@openssl.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}