{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Secure Analytics versions ant\u00e9rieures \u00e0 7.5.0 UP8 IF03",
      "product": {
        "name": "Secure Analytics",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2023-1382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1382"
    },
    {
      "name": "CVE-2023-4732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4732"
    },
    {
      "name": "CVE-2022-48564",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48564"
    },
    {
      "name": "CVE-2019-15505",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-15505"
    },
    {
      "name": "CVE-2023-52448",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52448"
    },
    {
      "name": "CVE-2023-3138",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3138"
    },
    {
      "name": "CVE-2023-46813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46813"
    },
    {
      "name": "CVE-2023-46218",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46218"
    },
    {
      "name": "CVE-2023-1838",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1838"
    },
    {
      "name": "CVE-2023-40551",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40551"
    },
    {
      "name": "CVE-2022-45934",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45934"
    },
    {
      "name": "CVE-2023-28328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28328"
    },
    {
      "name": "CVE-2023-51043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51043"
    },
    {
      "name": "CVE-2023-51385",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51385"
    },
    {
      "name": "CVE-2023-5633",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5633"
    },
    {
      "name": "CVE-2023-52425",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52425"
    },
    {
      "name": "CVE-2022-38457",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-38457"
    },
    {
      "name": "CVE-2023-38546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38546"
    },
    {
      "name": "CVE-2023-45863",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45863"
    },
    {
      "name": "CVE-2022-26691",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-26691"
    },
    {
      "name": "CVE-2023-6915",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6915"
    },
    {
      "name": "CVE-2023-5178",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5178"
    },
    {
      "name": "CVE-2024-26671",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26671"
    },
    {
      "name": "CVE-2023-50868",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50868"
    },
    {
      "name": "CVE-2023-6536",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6536"
    },
    {
      "name": "CVE-2023-37453",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37453"
    },
    {
      "name": "CVE-2023-23455",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-23455"
    },
    {
      "name": "CVE-2022-45061",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45061"
    },
    {
      "name": "CVE-2020-10001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10001"
    },
    {
      "name": "CVE-2024-0646",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-0646"
    },
    {
      "name": "CVE-2023-4091",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4091"
    },
    {
      "name": "CVE-2023-40283",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40283"
    },
    {
      "name": "CVE-2022-45884",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45884"
    },
    {
      "name": "CVE-2023-52489",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52489"
    },
    {
      "name": "CVE-2007-4559",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-4559"
    },
    {
      "name": "CVE-2023-33951",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33951"
    },
    {
      "name": "CVE-2023-2163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2163"
    },
    {
      "name": "CVE-2023-4133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4133"
    },
    {
      "name": "CVE-2022-42895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42895"
    },
    {
      "name": "CVE-2023-4244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4244"
    },
    {
      "name": "CVE-2022-40133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40133"
    },
    {
      "name": "CVE-2021-35939",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-35939"
    },
    {
      "name": "CVE-2023-39193",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39193"
    },
    {
      "name": "CVE-2023-28322",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28322"
    },
    {
      "name": "CVE-2024-22243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22243"
    },
    {
      "name": "CVE-2023-45862",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45862"
    },
    {
      "name": "CVE-2023-1989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1989"
    },
    {
      "name": "CVE-2020-3898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3898"
    },
    {
      "name": "CVE-2023-51779",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51779"
    },
    {
      "name": "CVE-2023-1855",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1855"
    },
    {
      "name": "CVE-2024-28784",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-28784"
    },
    {
      "name": "CVE-2022-45869",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45869"
    },
    {
      "name": "CVE-2023-2513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2513"
    },
    {
      "name": "CVE-2023-4408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4408"
    },
    {
      "name": "CVE-2023-42669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42669"
    },
    {
      "name": "CVE-2023-2828",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2828"
    },
    {
      "name": "CVE-2023-22081",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22081"
    },
    {
      "name": "CVE-2023-20569",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20569"
    },
    {
      "name": "CVE-2023-50961",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50961"
    },
    {
      "name": "CVE-2023-4206",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4206"
    },
    {
      "name": "CVE-2023-52340",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52340"
    },
    {
      "name": "CVE-2023-6817",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6817"
    },
    {
      "name": "CVE-2023-31084",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31084"
    },
    {
      "name": "CVE-2024-26609",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26609"
    },
    {
      "name": "CVE-2022-45919",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45919"
    },
    {
      "name": "CVE-2019-13224",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-13224"
    },
    {
      "name": "CVE-2022-41858",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41858"
    },
    {
      "name": "CVE-2023-3611",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3611"
    },
    {
      "name": "CVE-2023-4128",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4128"
    },
    {
      "name": "CVE-2023-34968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34968"
    },
    {
      "name": "CVE-2023-31436",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31436"
    },
    {
      "name": "CVE-2001-1267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2001-1267"
    },
    {
      "name": "CVE-2023-1074",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1074"
    },
    {
      "name": "CVE-2019-19204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-19204"
    },
    {
      "name": "CVE-2023-42753",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42753"
    },
    {
      "name": "CVE-2023-4921",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4921"
    },
    {
      "name": "CVE-2024-22262",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22262"
    },
    {
      "name": "CVE-2023-33203",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33203"
    },
    {
      "name": "CVE-2023-5981",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5981"
    },
    {
      "name": "CVE-2023-3812",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3812"
    },
    {
      "name": "CVE-2023-32360",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32360"
    },
    {
      "name": "CVE-2023-27043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27043"
    },
    {
      "name": "CVE-2023-39189",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39189"
    },
    {
      "name": "CVE-2023-48795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48795"
    },
    {
      "name": "CVE-2024-27269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27269"
    },
    {
      "name": "CVE-2023-38409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38409"
    },
    {
      "name": "CVE-2021-43975",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-43975"
    },
    {
      "name": "CVE-2023-4207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4207"
    },
    {
      "name": "CVE-2018-19787",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-19787"
    },
    {
      "name": "CVE-2023-28487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28487"
    },
    {
      "name": "CVE-2023-22067",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22067"
    },
    {
      "name": "CVE-2023-6135",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6135"
    },
    {
      "name": "CVE-2023-6356",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6356"
    },
    {
      "name": "CVE-2023-39198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39198"
    },
    {
      "name": "CVE-2024-1488",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1488"
    },
    {
      "name": "CVE-2023-1252",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1252"
    },
    {
      "name": "CVE-2021-3753",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3753"
    },
    {
      "name": "CVE-2022-3545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3545"
    },
    {
      "name": "CVE-2020-28241",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28241"
    },
    {
      "name": "CVE-2023-2176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2176"
    },
    {
      "name": "CVE-2023-2162",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2162"
    },
    {
      "name": "CVE-2023-1079",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1079"
    },
    {
      "name": "CVE-2022-36402",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-36402"
    },
    {
      "name": "CVE-2023-33952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33952"
    },
    {
      "name": "CVE-2023-32324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32324"
    },
    {
      "name": "CVE-2014-3146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-3146"
    },
    {
      "name": "CVE-2023-45803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45803"
    },
    {
      "name": "CVE-2023-3758",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3758"
    },
    {
      "name": "CVE-2023-3772",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3772"
    },
    {
      "name": "CVE-2023-34967",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34967"
    },
    {
      "name": "CVE-2022-4744",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-4744"
    },
    {
      "name": "CVE-2023-40546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40546"
    },
    {
      "name": "CVE-2021-35937",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-35937"
    },
    {
      "name": "CVE-2023-3161",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3161"
    },
    {
      "name": "CVE-2023-28464",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28464"
    },
    {
      "name": "CVE-2023-3341",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3341"
    },
    {
      "name": "CVE-2023-3567",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3567"
    },
    {
      "name": "CVE-2021-41043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41043"
    },
    {
      "name": "CVE-2023-35824",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-35824"
    },
    {
      "name": "CVE-2023-45871",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45871"
    },
    {
      "name": "CVE-2023-1998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1998"
    },
    {
      "name": "CVE-2023-28772",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28772"
    },
    {
      "name": "CVE-2023-52580",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52580"
    },
    {
      "name": "CVE-2022-40982",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40982"
    },
    {
      "name": "CVE-2019-16163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-16163"
    },
    {
      "name": "CVE-2023-1786",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1786"
    },
    {
      "name": "CVE-2024-0553",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-0553"
    },
    {
      "name": "CVE-2023-1075",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1075"
    },
    {
      "name": "CVE-2023-3609",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3609"
    },
    {
      "name": "CVE-2023-4155",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4155"
    },
    {
      "name": "CVE-2023-4208",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4208"
    },
    {
      "name": "CVE-2023-35823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-35823"
    },
    {
      "name": "CVE-2023-52574",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52574"
    },
    {
      "name": "CVE-2022-3565",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3565"
    },
    {
      "name": "CVE-2023-31083",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31083"
    },
    {
      "name": "CVE-2023-26545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26545"
    },
    {
      "name": "CVE-2022-3640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3640"
    },
    {
      "name": "CVE-2023-6176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6176"
    },
    {
      "name": "CVE-2022-45887",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45887"
    },
    {
      "name": "CVE-2023-6535",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6535"
    },
    {
      "name": "CVE-2023-25012",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25012"
    },
    {
      "name": "CVE-2022-0500",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0500"
    },
    {
      "name": "CVE-2024-0841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-0841"
    },
    {
      "name": "CVE-2019-19203",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-19203"
    },
    {
      "name": "CVE-2023-1118",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1118"
    },
    {
      "name": "CVE-2023-43804",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-43804"
    },
    {
      "name": "CVE-2020-25656",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-25656"
    },
    {
      "name": "CVE-2022-48560",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48560"
    },
    {
      "name": "CVE-2017-7500",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-7500"
    },
    {
      "name": "CVE-2022-3594",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3594"
    },
    {
      "name": "CVE-2023-51780",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51780"
    },
    {
      "name": "CVE-2023-52434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52434"
    },
    {
      "name": "CVE-2023-34241",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34241"
    },
    {
      "name": "CVE-2022-3094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3094"
    },
    {
      "name": "CVE-2024-25742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25742"
    },
    {
      "name": "CVE-2024-25743",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25743"
    },
    {
      "name": "CVE-2022-38096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-38096"
    },
    {
      "name": "CVE-2023-4622",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4622"
    },
    {
      "name": "CVE-2019-8696",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-8696"
    },
    {
      "name": "CVE-2024-26602",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26602"
    },
    {
      "name": "CVE-2023-3141",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3141"
    },
    {
      "name": "CVE-2021-4204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-4204"
    },
    {
      "name": "CVE-2022-28388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-28388"
    },
    {
      "name": "CVE-2023-30456",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-30456"
    },
    {
      "name": "CVE-2023-42465",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42465"
    },
    {
      "name": "CVE-2023-39192",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39192"
    },
    {
      "name": "CVE-2023-5676",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5676"
    },
    {
      "name": "CVE-2023-6606",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6606"
    },
    {
      "name": "CVE-2023-39194",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39194"
    },
    {
      "name": "CVE-2023-52620",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52620"
    },
    {
      "name": "CVE-2023-24023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-24023"
    },
    {
      "name": "CVE-2023-6932",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6932"
    },
    {
      "name": "CVE-2023-0458",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0458"
    },
    {
      "name": "CVE-2023-1073",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1073"
    },
    {
      "name": "CVE-2023-3212",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3212"
    },
    {
      "name": "CVE-2021-33631",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33631"
    },
    {
      "name": "CVE-2023-50387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50387"
    },
    {
      "name": "CVE-2023-40549",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40549"
    },
    {
      "name": "CVE-2023-1513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1513"
    },
    {
      "name": "CVE-2022-48624",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48624"
    },
    {
      "name": "CVE-2011-4969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4969"
    },
    {
      "name": "CVE-2021-35938",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-35938"
    },
    {
      "name": "CVE-2023-40548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40548"
    },
    {
      "name": "CVE-2023-0597",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0597"
    },
    {
      "name": "CVE-2024-22259",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22259"
    },
    {
      "name": "CVE-2022-46329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-46329"
    },
    {
      "name": "CVE-2023-34966",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34966"
    },
    {
      "name": "CVE-2023-26604",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26604"
    },
    {
      "name": "CVE-2023-6546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6546"
    },
    {
      "name": "CVE-2023-7192",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-7192"
    },
    {
      "name": "CVE-2023-4132",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4132"
    },
    {
      "name": "CVE-2022-26377",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-26377"
    },
    {
      "name": "CVE-2023-52581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52581"
    },
    {
      "name": "CVE-2023-40550",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40550"
    },
    {
      "name": "CVE-2019-13631",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-13631"
    },
    {
      "name": "CVE-2024-1086",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1086"
    },
    {
      "name": "CVE-2023-1206",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1206"
    },
    {
      "name": "CVE-2024-0565",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-0565"
    },
    {
      "name": "CVE-2019-8675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-8675"
    },
    {
      "name": "CVE-2023-4623",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4623"
    },
    {
      "name": "CVE-2023-51042",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51042"
    },
    {
      "name": "CVE-2023-42755",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42755"
    },
    {
      "name": "CVE-2023-0590",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0590"
    },
    {
      "name": "CVE-2023-39615",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39615"
    },
    {
      "name": "CVE-2017-7501",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-7501"
    },
    {
      "name": "CVE-2023-28486",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28486"
    },
    {
      "name": "CVE-2023-50960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50960"
    },
    {
      "name": "CVE-2015-9251",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-9251"
    },
    {
      "name": "CVE-2023-5388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5388"
    },
    {
      "name": "CVE-2023-3268",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3268"
    },
    {
      "name": "CVE-2023-25775",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25775"
    },
    {
      "name": "CVE-2012-6708",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-6708"
    },
    {
      "name": "CVE-2022-2127",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-2127"
    },
    {
      "name": "CVE-2020-7656",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7656"
    },
    {
      "name": "CVE-2023-5717",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5717"
    },
    {
      "name": "CVE-2019-19012",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-19012"
    },
    {
      "name": "CVE-2020-27783",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-27783"
    },
    {
      "name": "CVE-2023-6622",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6622"
    },
    {
      "name": "CVE-2021-43818",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-43818"
    },
    {
      "name": "CVE-2022-23222",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23222"
    },
    {
      "name": "CVE-2023-6121",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6121"
    },
    {
      "name": "CVE-2021-43618",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-43618"
    },
    {
      "name": "CVE-2023-2166",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2166"
    },
    {
      "name": "CVE-2023-1192",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1192"
    },
    {
      "name": "CVE-2023-40547",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40547"
    },
    {
      "name": "CVE-2023-6931",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6931"
    },
    {
      "name": "CVE-2023-6610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6610"
    },
    {
      "name": "CVE-2023-42754",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42754"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0506",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-06-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Juniper Networks. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Juniper Secure Analytics",
  "vendor_advisories": [
    {
      "published_at": "2024-06-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA82681",
      "url": "https://supportportal.juniper.net/s/article/On-Demand-JSA-Series-Multiple-vulnerabilities-resolved-in-Juniper-Secure-Analytics-in-7-5-0-UP8-IF03"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Secure Analytics versions ant\u00e9rieures \u00e0 7.5.0 UP8 IF03",
      "product": {
        "name": "Secure Analytics",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2023-1382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1382"
    },
    {
      "name": "CVE-2023-4732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4732"
    },
    {
      "name": "CVE-2022-48564",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48564"
    },
    {
      "name": "CVE-2019-15505",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-15505"
    },
    {
      "name": "CVE-2023-52448",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52448"
    },
    {
      "name": "CVE-2023-3138",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3138"
    },
    {
      "name": "CVE-2023-46813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46813"
    },
    {
      "name": "CVE-2023-46218",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46218"
    },
    {
      "name": "CVE-2023-1838",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1838"
    },
    {
      "name": "CVE-2023-40551",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40551"
    },
    {
      "name": "CVE-2022-45934",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45934"
    },
    {
      "name": "CVE-2023-28328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28328"
    },
    {
      "name": "CVE-2023-51043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51043"
    },
    {
      "name": "CVE-2023-51385",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51385"
    },
    {
      "name": "CVE-2023-5633",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5633"
    },
    {
      "name": "CVE-2023-52425",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52425"
    },
    {
      "name": "CVE-2022-38457",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-38457"
    },
    {
      "name": "CVE-2023-38546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38546"
    },
    {
      "name": "CVE-2023-45863",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45863"
    },
    {
      "name": "CVE-2022-26691",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-26691"
    },
    {
      "name": "CVE-2023-6915",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6915"
    },
    {
      "name": "CVE-2023-5178",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5178"
    },
    {
      "name": "CVE-2024-26671",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26671"
    },
    {
      "name": "CVE-2023-50868",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50868"
    },
    {
      "name": "CVE-2023-6536",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6536"
    },
    {
      "name": "CVE-2023-37453",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37453"
    },
    {
      "name": "CVE-2023-23455",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-23455"
    },
    {
      "name": "CVE-2022-45061",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45061"
    },
    {
      "name": "CVE-2020-10001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10001"
    },
    {
      "name": "CVE-2024-0646",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-0646"
    },
    {
      "name": "CVE-2023-4091",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4091"
    },
    {
      "name": "CVE-2023-40283",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40283"
    },
    {
      "name": "CVE-2022-45884",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45884"
    },
    {
      "name": "CVE-2023-52489",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52489"
    },
    {
      "name": "CVE-2007-4559",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-4559"
    },
    {
      "name": "CVE-2023-33951",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33951"
    },
    {
      "name": "CVE-2023-2163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2163"
    },
    {
      "name": "CVE-2023-4133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4133"
    },
    {
      "name": "CVE-2022-42895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42895"
    },
    {
      "name": "CVE-2023-4244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4244"
    },
    {
      "name": "CVE-2022-40133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40133"
    },
    {
      "name": "CVE-2021-35939",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-35939"
    },
    {
      "name": "CVE-2023-39193",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39193"
    },
    {
      "name": "CVE-2023-28322",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28322"
    },
    {
      "name": "CVE-2024-22243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22243"
    },
    {
      "name": "CVE-2023-45862",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45862"
    },
    {
      "name": "CVE-2023-1989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1989"
    },
    {
      "name": "CVE-2020-3898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3898"
    },
    {
      "name": "CVE-2023-51779",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51779"
    },
    {
      "name": "CVE-2023-1855",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1855"
    },
    {
      "name": "CVE-2024-28784",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-28784"
    },
    {
      "name": "CVE-2022-45869",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45869"
    },
    {
      "name": "CVE-2023-2513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2513"
    },
    {
      "name": "CVE-2023-4408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4408"
    },
    {
      "name": "CVE-2023-42669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42669"
    },
    {
      "name": "CVE-2023-2828",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2828"
    },
    {
      "name": "CVE-2023-22081",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22081"
    },
    {
      "name": "CVE-2023-20569",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20569"
    },
    {
      "name": "CVE-2023-50961",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50961"
    },
    {
      "name": "CVE-2023-4206",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4206"
    },
    {
      "name": "CVE-2023-52340",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52340"
    },
    {
      "name": "CVE-2023-6817",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6817"
    },
    {
      "name": "CVE-2023-31084",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31084"
    },
    {
      "name": "CVE-2024-26609",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26609"
    },
    {
      "name": "CVE-2022-45919",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45919"
    },
    {
      "name": "CVE-2019-13224",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-13224"
    },
    {
      "name": "CVE-2022-41858",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41858"
    },
    {
      "name": "CVE-2023-3611",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3611"
    },
    {
      "name": "CVE-2023-4128",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4128"
    },
    {
      "name": "CVE-2023-34968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34968"
    },
    {
      "name": "CVE-2023-31436",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31436"
    },
    {
      "name": "CVE-2001-1267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2001-1267"
    },
    {
      "name": "CVE-2023-1074",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1074"
    },
    {
      "name": "CVE-2019-19204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-19204"
    },
    {
      "name": "CVE-2023-42753",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42753"
    },
    {
      "name": "CVE-2023-4921",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4921"
    },
    {
      "name": "CVE-2024-22262",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22262"
    },
    {
      "name": "CVE-2023-33203",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33203"
    },
    {
      "name": "CVE-2023-5981",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5981"
    },
    {
      "name": "CVE-2023-3812",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3812"
    },
    {
      "name": "CVE-2023-32360",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32360"
    },
    {
      "name": "CVE-2023-27043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27043"
    },
    {
      "name": "CVE-2023-39189",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39189"
    },
    {
      "name": "CVE-2023-48795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48795"
    },
    {
      "name": "CVE-2024-27269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27269"
    },
    {
      "name": "CVE-2023-38409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38409"
    },
    {
      "name": "CVE-2021-43975",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-43975"
    },
    {
      "name": "CVE-2023-4207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4207"
    },
    {
      "name": "CVE-2018-19787",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-19787"
    },
    {
      "name": "CVE-2023-28487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28487"
    },
    {
      "name": "CVE-2023-22067",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22067"
    },
    {
      "name": "CVE-2023-6135",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6135"
    },
    {
      "name": "CVE-2023-6356",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6356"
    },
    {
      "name": "CVE-2023-39198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39198"
    },
    {
      "name": "CVE-2024-1488",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1488"
    },
    {
      "name": "CVE-2023-1252",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1252"
    },
    {
      "name": "CVE-2021-3753",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3753"
    },
    {
      "name": "CVE-2022-3545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3545"
    },
    {
      "name": "CVE-2020-28241",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28241"
    },
    {
      "name": "CVE-2023-2176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2176"
    },
    {
      "name": "CVE-2023-2162",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2162"
    },
    {
      "name": "CVE-2023-1079",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1079"
    },
    {
      "name": "CVE-2022-36402",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-36402"
    },
    {
      "name": "CVE-2023-33952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33952"
    },
    {
      "name": "CVE-2023-32324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32324"
    },
    {
      "name": "CVE-2014-3146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-3146"
    },
    {
      "name": "CVE-2023-45803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45803"
    },
    {
      "name": "CVE-2023-3758",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3758"
    },
    {
      "name": "CVE-2023-3772",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3772"
    },
    {
      "name": "CVE-2023-34967",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34967"
    },
    {
      "name": "CVE-2022-4744",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-4744"
    },
    {
      "name": "CVE-2023-40546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40546"
    },
    {
      "name": "CVE-2021-35937",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-35937"
    },
    {
      "name": "CVE-2023-3161",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3161"
    },
    {
      "name": "CVE-2023-28464",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28464"
    },
    {
      "name": "CVE-2023-3341",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3341"
    },
    {
      "name": "CVE-2023-3567",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3567"
    },
    {
      "name": "CVE-2021-41043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41043"
    },
    {
      "name": "CVE-2023-35824",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-35824"
    },
    {
      "name": "CVE-2023-45871",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45871"
    },
    {
      "name": "CVE-2023-1998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1998"
    },
    {
      "name": "CVE-2023-28772",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28772"
    },
    {
      "name": "CVE-2023-52580",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52580"
    },
    {
      "name": "CVE-2022-40982",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40982"
    },
    {
      "name": "CVE-2019-16163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-16163"
    },
    {
      "name": "CVE-2023-1786",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1786"
    },
    {
      "name": "CVE-2024-0553",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-0553"
    },
    {
      "name": "CVE-2023-1075",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1075"
    },
    {
      "name": "CVE-2023-3609",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3609"
    },
    {
      "name": "CVE-2023-4155",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4155"
    },
    {
      "name": "CVE-2023-4208",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4208"
    },
    {
      "name": "CVE-2023-35823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-35823"
    },
    {
      "name": "CVE-2023-52574",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52574"
    },
    {
      "name": "CVE-2022-3565",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3565"
    },
    {
      "name": "CVE-2023-31083",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31083"
    },
    {
      "name": "CVE-2023-26545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26545"
    },
    {
      "name": "CVE-2022-3640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3640"
    },
    {
      "name": "CVE-2023-6176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6176"
    },
    {
      "name": "CVE-2022-45887",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45887"
    },
    {
      "name": "CVE-2023-6535",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6535"
    },
    {
      "name": "CVE-2023-25012",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25012"
    },
    {
      "name": "CVE-2022-0500",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0500"
    },
    {
      "name": "CVE-2024-0841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-0841"
    },
    {
      "name": "CVE-2019-19203",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-19203"
    },
    {
      "name": "CVE-2023-1118",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1118"
    },
    {
      "name": "CVE-2023-43804",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-43804"
    },
    {
      "name": "CVE-2020-25656",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-25656"
    },
    {
      "name": "CVE-2022-48560",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48560"
    },
    {
      "name": "CVE-2017-7500",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-7500"
    },
    {
      "name": "CVE-2022-3594",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3594"
    },
    {
      "name": "CVE-2023-51780",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51780"
    },
    {
      "name": "CVE-2023-52434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52434"
    },
    {
      "name": "CVE-2023-34241",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34241"
    },
    {
      "name": "CVE-2022-3094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3094"
    },
    {
      "name": "CVE-2024-25742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25742"
    },
    {
      "name": "CVE-2024-25743",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25743"
    },
    {
      "name": "CVE-2022-38096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-38096"
    },
    {
      "name": "CVE-2023-4622",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4622"
    },
    {
      "name": "CVE-2019-8696",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-8696"
    },
    {
      "name": "CVE-2024-26602",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26602"
    },
    {
      "name": "CVE-2023-3141",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3141"
    },
    {
      "name": "CVE-2021-4204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-4204"
    },
    {
      "name": "CVE-2022-28388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-28388"
    },
    {
      "name": "CVE-2023-30456",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-30456"
    },
    {
      "name": "CVE-2023-42465",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42465"
    },
    {
      "name": "CVE-2023-39192",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39192"
    },
    {
      "name": "CVE-2023-5676",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5676"
    },
    {
      "name": "CVE-2023-6606",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6606"
    },
    {
      "name": "CVE-2023-39194",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39194"
    },
    {
      "name": "CVE-2023-52620",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52620"
    },
    {
      "name": "CVE-2023-24023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-24023"
    },
    {
      "name": "CVE-2023-6932",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6932"
    },
    {
      "name": "CVE-2023-0458",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0458"
    },
    {
      "name": "CVE-2023-1073",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1073"
    },
    {
      "name": "CVE-2023-3212",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3212"
    },
    {
      "name": "CVE-2021-33631",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33631"
    },
    {
      "name": "CVE-2023-50387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50387"
    },
    {
      "name": "CVE-2023-40549",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40549"
    },
    {
      "name": "CVE-2023-1513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1513"
    },
    {
      "name": "CVE-2022-48624",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48624"
    },
    {
      "name": "CVE-2011-4969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4969"
    },
    {
      "name": "CVE-2021-35938",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-35938"
    },
    {
      "name": "CVE-2023-40548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40548"
    },
    {
      "name": "CVE-2023-0597",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0597"
    },
    {
      "name": "CVE-2024-22259",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22259"
    },
    {
      "name": "CVE-2022-46329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-46329"
    },
    {
      "name": "CVE-2023-34966",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34966"
    },
    {
      "name": "CVE-2023-26604",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26604"
    },
    {
      "name": "CVE-2023-6546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6546"
    },
    {
      "name": "CVE-2023-7192",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-7192"
    },
    {
      "name": "CVE-2023-4132",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4132"
    },
    {
      "name": "CVE-2022-26377",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-26377"
    },
    {
      "name": "CVE-2023-52581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52581"
    },
    {
      "name": "CVE-2023-40550",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40550"
    },
    {
      "name": "CVE-2019-13631",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-13631"
    },
    {
      "name": "CVE-2024-1086",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1086"
    },
    {
      "name": "CVE-2023-1206",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1206"
    },
    {
      "name": "CVE-2024-0565",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-0565"
    },
    {
      "name": "CVE-2019-8675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-8675"
    },
    {
      "name": "CVE-2023-4623",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4623"
    },
    {
      "name": "CVE-2023-51042",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51042"
    },
    {
      "name": "CVE-2023-42755",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42755"
    },
    {
      "name": "CVE-2023-0590",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0590"
    },
    {
      "name": "CVE-2023-39615",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39615"
    },
    {
      "name": "CVE-2017-7501",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-7501"
    },
    {
      "name": "CVE-2023-28486",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28486"
    },
    {
      "name": "CVE-2023-50960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50960"
    },
    {
      "name": "CVE-2015-9251",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-9251"
    },
    {
      "name": "CVE-2023-5388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5388"
    },
    {
      "name": "CVE-2023-3268",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3268"
    },
    {
      "name": "CVE-2023-25775",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25775"
    },
    {
      "name": "CVE-2012-6708",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-6708"
    },
    {
      "name": "CVE-2022-2127",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-2127"
    },
    {
      "name": "CVE-2020-7656",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7656"
    },
    {
      "name": "CVE-2023-5717",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5717"
    },
    {
      "name": "CVE-2019-19012",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-19012"
    },
    {
      "name": "CVE-2020-27783",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-27783"
    },
    {
      "name": "CVE-2023-6622",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6622"
    },
    {
      "name": "CVE-2021-43818",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-43818"
    },
    {
      "name": "CVE-2022-23222",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23222"
    },
    {
      "name": "CVE-2023-6121",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6121"
    },
    {
      "name": "CVE-2021-43618",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-43618"
    },
    {
      "name": "CVE-2023-2166",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2166"
    },
    {
      "name": "CVE-2023-1192",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1192"
    },
    {
      "name": "CVE-2023-40547",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40547"
    },
    {
      "name": "CVE-2023-6931",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6931"
    },
    {
      "name": "CVE-2023-6610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6610"
    },
    {
      "name": "CVE-2023-42754",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42754"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0506",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-06-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Juniper Networks. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Juniper Secure Analytics",
  "vendor_advisories": [
    {
      "published_at": "2024-06-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA82681",
      "url": "https://supportportal.juniper.net/s/article/On-Demand-JSA-Series-Multiple-vulnerabilities-resolved-in-Juniper-Secure-Analytics-in-7-5-0-UP8-IF03"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "QRadar SIEM versions 7.5.x ant\u00e9rieures \u00e0 7.5.0 UP8 IF03",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "AIX versions 7.2 et 7.3 sans la derni\u00e8re version du fichier bind.rte",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "MaaS360 Mobile Enterprise Gateway (MEG) versions ant\u00e9rieures \u00e0 3.000.800",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Sterling Transformation Extender versions 11.x ant\u00e9rieures \u00e0 11.0.0.0 sans le correctif de s\u00e9curit\u00e9 PH61425",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions 11.1.4 \u00e0 11.1.4.7 sans le dernier correctif de s\u00e9curit\u00e9 pour TSAMP",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "MaaS360 VPN versions ant\u00e9rieures \u00e0 3.000.800",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions 10.5.0 \u00e0 10.5.11 sans le dernier correctif de s\u00e9curit\u00e9 pour Tivoli System Automation for Multiplatforms (TSAMP)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "VIOS versions 3.1 et 4.1 sans la derni\u00e8re version du fichier bind.rte",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions 11.5.0 \u00e0 11.1.5.9 sans le dernier correctif de s\u00e9curit\u00e9 pour TSAMP",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Sterling Transformation Extender versions 10.1.1.x ant\u00e9rieures \u00e0 10.1.1.1 sans le correctif de s\u00e9curit\u00e9 PH61425",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Sterling Transformation Extender versions 10.1.0.x ant\u00e9rieures \u00e0 10.1.0.2 sans le correctif de s\u00e9curit\u00e9 PH61425",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Sterling Transformation Extender versions 10.1.2.x ant\u00e9rieures \u00e0 10.1.2.1 sans le correctif de s\u00e9curit\u00e9 PH61425",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-20919",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20919"
    },
    {
      "name": "CVE-2023-38264",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38264"
    },
    {
      "name": "CVE-2024-22201",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22201"
    },
    {
      "name": "CVE-2023-40551",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40551"
    },
    {
      "name": "CVE-2024-20926",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20926"
    },
    {
      "name": "CVE-2023-50868",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50868"
    },
    {
      "name": "CVE-2024-20921",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20921"
    },
    {
      "name": "CVE-2024-22243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22243"
    },
    {
      "name": "CVE-2024-29025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-29025"
    },
    {
      "name": "CVE-2023-4408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4408"
    },
    {
      "name": "CVE-2024-22262",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22262"
    },
    {
      "name": "CVE-2024-21011",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21011"
    },
    {
      "name": "CVE-2023-5517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5517"
    },
    {
      "name": "CVE-2023-3758",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3758"
    },
    {
      "name": "CVE-2023-40546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40546"
    },
    {
      "name": "CVE-2024-21094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21094"
    },
    {
      "name": "CVE-2023-6237",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6237"
    },
    {
      "name": "CVE-2023-33850",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33850"
    },
    {
      "name": "CVE-2024-0727",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-0727"
    },
    {
      "name": "CVE-2023-6129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6129"
    },
    {
      "name": "CVE-2023-50387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50387"
    },
    {
      "name": "CVE-2023-40549",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40549"
    },
    {
      "name": "CVE-2024-20918",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20918"
    },
    {
      "name": "CVE-2023-40548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40548"
    },
    {
      "name": "CVE-2024-22259",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22259"
    },
    {
      "name": "CVE-2023-6516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6516"
    },
    {
      "name": "CVE-2023-40550",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40550"
    },
    {
      "name": "CVE-2024-21085",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21085"
    },
    {
      "name": "CVE-2024-20945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20945"
    },
    {
      "name": "CVE-2023-5679",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5679"
    },
    {
      "name": "CVE-2024-20952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20952"
    },
    {
      "name": "CVE-2023-40547",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40547"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0470",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-06-07T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": "2024-06-06",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7156667",
      "url": "https://www.ibm.com/support/pages/node/7156667"
    },
    {
      "published_at": "2024-06-03",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7156255",
      "url": "https://www.ibm.com/support/pages/node/7156255"
    },
    {
      "published_at": "2024-06-05",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7156525",
      "url": "https://www.ibm.com/support/pages/node/7156525"
    },
    {
      "published_at": "2024-06-04",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7156443",
      "url": "https://www.ibm.com/support/pages/node/7156443"
    },
    {
      "published_at": "2024-06-03",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7156292",
      "url": "https://www.ibm.com/support/pages/node/7156292"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "QRadar SIEM versions 7.5.x ant\u00e9rieures \u00e0 7.5.0 UP8 IF03",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "AIX versions 7.2 et 7.3 sans la derni\u00e8re version du fichier bind.rte",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "MaaS360 Mobile Enterprise Gateway (MEG) versions ant\u00e9rieures \u00e0 3.000.800",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Sterling Transformation Extender versions 11.x ant\u00e9rieures \u00e0 11.0.0.0 sans le correctif de s\u00e9curit\u00e9 PH61425",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions 11.1.4 \u00e0 11.1.4.7 sans le dernier correctif de s\u00e9curit\u00e9 pour TSAMP",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "MaaS360 VPN versions ant\u00e9rieures \u00e0 3.000.800",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions 10.5.0 \u00e0 10.5.11 sans le dernier correctif de s\u00e9curit\u00e9 pour Tivoli System Automation for Multiplatforms (TSAMP)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "VIOS versions 3.1 et 4.1 sans la derni\u00e8re version du fichier bind.rte",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions 11.5.0 \u00e0 11.1.5.9 sans le dernier correctif de s\u00e9curit\u00e9 pour TSAMP",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Sterling Transformation Extender versions 10.1.1.x ant\u00e9rieures \u00e0 10.1.1.1 sans le correctif de s\u00e9curit\u00e9 PH61425",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Sterling Transformation Extender versions 10.1.0.x ant\u00e9rieures \u00e0 10.1.0.2 sans le correctif de s\u00e9curit\u00e9 PH61425",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Sterling Transformation Extender versions 10.1.2.x ant\u00e9rieures \u00e0 10.1.2.1 sans le correctif de s\u00e9curit\u00e9 PH61425",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-20919",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20919"
    },
    {
      "name": "CVE-2023-38264",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38264"
    },
    {
      "name": "CVE-2024-22201",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22201"
    },
    {
      "name": "CVE-2023-40551",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40551"
    },
    {
      "name": "CVE-2024-20926",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20926"
    },
    {
      "name": "CVE-2023-50868",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50868"
    },
    {
      "name": "CVE-2024-20921",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20921"
    },
    {
      "name": "CVE-2024-22243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22243"
    },
    {
      "name": "CVE-2024-29025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-29025"
    },
    {
      "name": "CVE-2023-4408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4408"
    },
    {
      "name": "CVE-2024-22262",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22262"
    },
    {
      "name": "CVE-2024-21011",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21011"
    },
    {
      "name": "CVE-2023-5517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5517"
    },
    {
      "name": "CVE-2023-3758",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3758"
    },
    {
      "name": "CVE-2023-40546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40546"
    },
    {
      "name": "CVE-2024-21094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21094"
    },
    {
      "name": "CVE-2023-6237",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6237"
    },
    {
      "name": "CVE-2023-33850",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33850"
    },
    {
      "name": "CVE-2024-0727",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-0727"
    },
    {
      "name": "CVE-2023-6129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6129"
    },
    {
      "name": "CVE-2023-50387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50387"
    },
    {
      "name": "CVE-2023-40549",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40549"
    },
    {
      "name": "CVE-2024-20918",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20918"
    },
    {
      "name": "CVE-2023-40548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40548"
    },
    {
      "name": "CVE-2024-22259",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22259"
    },
    {
      "name": "CVE-2023-6516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6516"
    },
    {
      "name": "CVE-2023-40550",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40550"
    },
    {
      "name": "CVE-2024-21085",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21085"
    },
    {
      "name": "CVE-2024-20945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20945"
    },
    {
      "name": "CVE-2023-5679",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5679"
    },
    {
      "name": "CVE-2024-20952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20952"
    },
    {
      "name": "CVE-2023-40547",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40547"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0470",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-06-07T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": "2024-06-06",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7156667",
      "url": "https://www.ibm.com/support/pages/node/7156667"
    },
    {
      "published_at": "2024-06-03",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7156255",
      "url": "https://www.ibm.com/support/pages/node/7156255"
    },
    {
      "published_at": "2024-06-05",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7156525",
      "url": "https://www.ibm.com/support/pages/node/7156525"
    },
    {
      "published_at": "2024-06-04",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7156443",
      "url": "https://www.ibm.com/support/pages/node/7156443"
    },
    {
      "published_at": "2024-06-03",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7156292",
      "url": "https://www.ibm.com/support/pages/node/7156292"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for shim is now available for Red Hat Enterprise Linux 8.8 Extended\nUpdate Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:1883",
        "url": "https://access.redhat.com/errata/RHSA-2024:1883"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2234589",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2234589"
      },
      {
        "category": "external",
        "summary": "2241782",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241782"
      },
      {
        "category": "external",
        "summary": "2241796",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241796"
      },
      {
        "category": "external",
        "summary": "2241797",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241797"
      },
      {
        "category": "external",
        "summary": "2259915",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259915"
      },
      {
        "category": "external",
        "summary": "2259918",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259918"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1883.json"
      }
    ],
    "title": "Red Hat Security Advisory: shim security update",
    "tracking": {
      "current_release_date": "2026-03-18T02:36:38+00:00",
      "generator": {
        "date": "2026-03-18T02:36:38+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.3"
        }
      },
      "id": "RHSA-2024:1883",
      "initial_release_date": "2024-04-18T01:56:22+00:00",
      "revision_history": [
        {
          "date": "2024-04-18T01:56:22+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-04-18T01:56:22+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-18T02:36:38+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat CodeReady Linux Builder EUS (v.8.8)",
                "product": {
                  "name": "Red Hat CodeReady Linux Builder EUS (v.8.8)",
                  "product_id": "CRB-8.8.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:8.8::crb"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
                  "product_id": "BaseOS-8.8.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus:8.8::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-unsigned-x64-0:15.8-2.el8.src",
                "product": {
                  "name": "shim-unsigned-x64-0:15.8-2.el8.src",
                  "product_id": "shim-unsigned-x64-0:15.8-2.el8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-unsigned-x64@15.8-2.el8?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "shim-0:15.8-2.el8.src",
                "product": {
                  "name": "shim-0:15.8-2.el8.src",
                  "product_id": "shim-0:15.8-2.el8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim@15.8-2.el8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-unsigned-x64-0:15.8-2.el8.x86_64",
                "product": {
                  "name": "shim-unsigned-x64-0:15.8-2.el8.x86_64",
                  "product_id": "shim-unsigned-x64-0:15.8-2.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-unsigned-x64@15.8-2.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "shim-ia32-0:15.8-2.el8.x86_64",
                "product": {
                  "name": "shim-ia32-0:15.8-2.el8.x86_64",
                  "product_id": "shim-ia32-0:15.8-2.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-ia32@15.8-2.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "shim-x64-0:15.8-2.el8.x86_64",
                "product": {
                  "name": "shim-x64-0:15.8-2.el8.x86_64",
                  "product_id": "shim-x64-0:15.8-2.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-x64@15.8-2.el8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-aa64-0:15.8-2.el8.aarch64",
                "product": {
                  "name": "shim-aa64-0:15.8-2.el8.aarch64",
                  "product_id": "shim-aa64-0:15.8-2.el8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-aa64@15.8-2.el8?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-0:15.8-2.el8.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src"
        },
        "product_reference": "shim-0:15.8-2.el8.src",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-aa64-0:15.8-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64"
        },
        "product_reference": "shim-aa64-0:15.8-2.el8.aarch64",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-ia32-0:15.8-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64"
        },
        "product_reference": "shim-ia32-0:15.8-2.el8.x86_64",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-x64-0:15.8-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64"
        },
        "product_reference": "shim-x64-0:15.8-2.el8.x86_64",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-unsigned-x64-0:15.8-2.el8.src as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)",
          "product_id": "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src"
        },
        "product_reference": "shim-unsigned-x64-0:15.8-2.el8.src",
        "relates_to_product_reference": "CRB-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-unsigned-x64-0:15.8-2.el8.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)",
          "product_id": "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
        },
        "product_reference": "shim-unsigned-x64-0:15.8-2.el8.x86_64",
        "relates_to_product_reference": "CRB-8.8.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-40546",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241796"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn\u0027t match the format string used by it, leading to a crash under certain circumstances.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bounds read printing error messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
          "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
          "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
          "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
          "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
          "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40546"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241796",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241796"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40546",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40546"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40546",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40546"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T01:56:22+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1883"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bounds read printing error messages"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Bill Demirkapi"
          ],
          "organization": "Microsoft Security Response Center"
        }
      ],
      "cve": "CVE-2023-40547",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2023-05-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2234589"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: RCE in http boot support may lead to Secure Boot bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot\u0027s previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
          "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
          "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
          "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
          "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
          "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40547"
        },
        {
          "category": "external",
          "summary": "RHBZ#2234589",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2234589"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40547",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40547"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40547",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40547"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T01:56:22+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1883"
        },
        {
          "category": "workaround",
          "details": "If a system isn\u2019t required to boot from the network, configure the server\u2019s boot order to disable entirely or skip the network boot.",
          "product_ids": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "shim: RCE in http boot support may lead to Secure Boot bypass"
    },
    {
      "cve": "CVE-2023-40548",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241782"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
          "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
          "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
          "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
          "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
          "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40548"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241782",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241782"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40548",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40548"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40548",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40548"
        }
      ],
      "release_date": "2023-10-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T01:56:22+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1883"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems"
    },
    {
      "cve": "CVE-2023-40549",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241797"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
          "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
          "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
          "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
          "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
          "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40549"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241797",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241797"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40549",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40549"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40549",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40549"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T01:56:22+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1883"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file"
    },
    {
      "cve": "CVE-2023-40550",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-01-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2259915"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system\u0027s boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bound read in verify_buffer_sbat()",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
          "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
          "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
          "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
          "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
          "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40550"
        },
        {
          "category": "external",
          "summary": "RHBZ#2259915",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259915"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40550",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40550"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40550",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40550"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T01:56:22+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1883"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bound read in verify_buffer_sbat()"
    },
    {
      "cve": "CVE-2023-40551",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2023-07-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2259918"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system\u0027s boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: out of bounds read when parsing MZ binaries",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
          "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
          "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
          "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
          "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
          "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40551"
        },
        {
          "category": "external",
          "summary": "RHBZ#2259918",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259918"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40551",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40551"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40551",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40551"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T01:56:22+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1883"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src",
            "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64",
            "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64",
            "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src",
            "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: out of bounds read when parsing MZ binaries"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for shim is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:1876",
        "url": "https://access.redhat.com/errata/RHSA-2024:1876"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2234589",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2234589"
      },
      {
        "category": "external",
        "summary": "2241782",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241782"
      },
      {
        "category": "external",
        "summary": "2241796",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241796"
      },
      {
        "category": "external",
        "summary": "2241797",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241797"
      },
      {
        "category": "external",
        "summary": "2259915",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259915"
      },
      {
        "category": "external",
        "summary": "2259918",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259918"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1876.json"
      }
    ],
    "title": "Red Hat Security Advisory: shim bug fix update",
    "tracking": {
      "current_release_date": "2024-11-24T14:20:01+00:00",
      "generator": {
        "date": "2024-11-24T14:20:01+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2024:1876",
      "initial_release_date": "2024-04-18T01:47:33+00:00",
      "revision_history": [
        {
          "date": "2024-04-18T01:47:33+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-04-18T01:47:33+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-24T14:20:01+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
                  "product_id": "BaseOS-9.2.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus:9.2::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-0:15.8-3.el9_2.src",
                "product": {
                  "name": "shim-0:15.8-3.el9_2.src",
                  "product_id": "shim-0:15.8-3.el9_2.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim@15.8-3.el9_2?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-aa64-0:15.8-3.el9_2.aarch64",
                "product": {
                  "name": "shim-aa64-0:15.8-3.el9_2.aarch64",
                  "product_id": "shim-aa64-0:15.8-3.el9_2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-aa64@15.8-3.el9_2?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-x64-0:15.8-3.el9_2.x86_64",
                "product": {
                  "name": "shim-x64-0:15.8-3.el9_2.x86_64",
                  "product_id": "shim-x64-0:15.8-3.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-x64@15.8-3.el9_2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-0:15.8-3.el9_2.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src"
        },
        "product_reference": "shim-0:15.8-3.el9_2.src",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-aa64-0:15.8-3.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64"
        },
        "product_reference": "shim-aa64-0:15.8-3.el9_2.aarch64",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-x64-0:15.8-3.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
        },
        "product_reference": "shim-x64-0:15.8-3.el9_2.x86_64",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-40546",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241796"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn\u0027t match the format string used by it, leading to a crash under certain circumstances.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bounds read printing error messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
          "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
          "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40546"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241796",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241796"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40546",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40546"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40546",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40546"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T01:47:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1876"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bounds read printing error messages"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Bill Demirkapi"
          ],
          "organization": "Microsoft Security Response Center"
        }
      ],
      "cve": "CVE-2023-40547",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2023-05-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2234589"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: RCE in http boot support may lead to Secure Boot bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot\u0027s previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
          "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
          "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40547"
        },
        {
          "category": "external",
          "summary": "RHBZ#2234589",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2234589"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40547",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40547"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40547",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40547"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T01:47:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1876"
        },
        {
          "category": "workaround",
          "details": "If a system isn\u2019t required to boot from the network, configure the server\u2019s boot order to disable entirely or skip the network boot.",
          "product_ids": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "shim: RCE in http boot support may lead to Secure Boot bypass"
    },
    {
      "cve": "CVE-2023-40548",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241782"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
          "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
          "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40548"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241782",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241782"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40548",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40548"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40548",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40548"
        }
      ],
      "release_date": "2023-10-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T01:47:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1876"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems"
    },
    {
      "cve": "CVE-2023-40549",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241797"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
          "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
          "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40549"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241797",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241797"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40549",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40549"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40549",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40549"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T01:47:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1876"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file"
    },
    {
      "cve": "CVE-2023-40550",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-01-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2259915"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system\u0027s boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bound read in verify_buffer_sbat()",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
          "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
          "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40550"
        },
        {
          "category": "external",
          "summary": "RHBZ#2259915",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259915"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40550",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40550"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40550",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40550"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T01:47:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1876"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bound read in verify_buffer_sbat()"
    },
    {
      "cve": "CVE-2023-40551",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2023-07-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2259918"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system\u0027s boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: out of bounds read when parsing MZ binaries",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
          "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
          "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40551"
        },
        {
          "category": "external",
          "summary": "RHBZ#2259918",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259918"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40551",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40551"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40551",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40551"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T01:47:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1876"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src",
            "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64",
            "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: out of bounds read when parsing MZ binaries"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for shim is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nIMPORTANT: The new shim revokes ALL VERSIONS of GRUB2 before grub2-2.02-0.87.el7_9.14. Therefore GRUB2 MUST be updated to the latest\nversion: grub2-2.02-0.87.el7_9.14 BEFORE or SIMULTANEOUSLY with this shim in order for Secure Boot to continue to work. Failure to update GRUB2 will result in an UNBOOTABLE system.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:1959",
        "url": "https://access.redhat.com/errata/RHSA-2024:1959"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2234589",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2234589"
      },
      {
        "category": "external",
        "summary": "2241782",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241782"
      },
      {
        "category": "external",
        "summary": "2241796",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241796"
      },
      {
        "category": "external",
        "summary": "2241797",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241797"
      },
      {
        "category": "external",
        "summary": "2259915",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259915"
      },
      {
        "category": "external",
        "summary": "2259918",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259918"
      },
      {
        "category": "external",
        "summary": "RHEL-2155",
        "url": "https://issues.redhat.com/browse/RHEL-2155"
      },
      {
        "category": "external",
        "summary": "RHEL-4382",
        "url": "https://issues.redhat.com/browse/RHEL-4382"
      },
      {
        "category": "external",
        "summary": "RHEL-4390",
        "url": "https://issues.redhat.com/browse/RHEL-4390"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1959.json"
      }
    ],
    "title": "Red Hat Security Advisory: shim security update",
    "tracking": {
      "current_release_date": "2024-11-24T14:20:40+00:00",
      "generator": {
        "date": "2024-11-24T14:20:40+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2024:1959",
      "initial_release_date": "2024-04-23T01:00:12+00:00",
      "revision_history": [
        {
          "date": "2024-04-23T01:00:12+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-04-23T01:00:12+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-24T14:20:40+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Client (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Client (v. 7)",
                  "product_id": "7Client-7.9.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 7)",
                  "product_id": "7Server-7.9.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Workstation (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Workstation (v. 7)",
                  "product_id": "7Workstation-7.9.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-0:15.8-3.el7.src",
                "product": {
                  "name": "shim-0:15.8-3.el7.src",
                  "product_id": "shim-0:15.8-3.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim@15.8-3.el7?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "shim-signed-0:15.8-1.el7.src",
                "product": {
                  "name": "shim-signed-0:15.8-1.el7.src",
                  "product_id": "shim-signed-0:15.8-1.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-signed@15.8-1.el7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-unsigned-ia32-0:15.8-3.el7.x86_64",
                "product": {
                  "name": "shim-unsigned-ia32-0:15.8-3.el7.x86_64",
                  "product_id": "shim-unsigned-ia32-0:15.8-3.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-unsigned-ia32@15.8-3.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "shim-unsigned-x64-0:15.8-3.el7.x86_64",
                "product": {
                  "name": "shim-unsigned-x64-0:15.8-3.el7.x86_64",
                  "product_id": "shim-unsigned-x64-0:15.8-3.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-unsigned-x64@15.8-3.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mokutil-0:15.8-1.el7.x86_64",
                "product": {
                  "name": "mokutil-0:15.8-1.el7.x86_64",
                  "product_id": "mokutil-0:15.8-1.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mokutil@15.8-1.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "shim-ia32-0:15.8-1.el7.x86_64",
                "product": {
                  "name": "shim-ia32-0:15.8-1.el7.x86_64",
                  "product_id": "shim-ia32-0:15.8-1.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-ia32@15.8-1.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "shim-x64-0:15.8-1.el7.x86_64",
                "product": {
                  "name": "shim-x64-0:15.8-1.el7.x86_64",
                  "product_id": "shim-x64-0:15.8-1.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-x64@15.8-1.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mokutil-debuginfo-0:15.8-1.el7.x86_64",
                "product": {
                  "name": "mokutil-debuginfo-0:15.8-1.el7.x86_64",
                  "product_id": "mokutil-debuginfo-0:15.8-1.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mokutil-debuginfo@15.8-1.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mokutil-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64"
        },
        "product_reference": "mokutil-0:15.8-1.el7.x86_64",
        "relates_to_product_reference": "7Client-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mokutil-debuginfo-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64"
        },
        "product_reference": "mokutil-debuginfo-0:15.8-1.el7.x86_64",
        "relates_to_product_reference": "7Client-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-0:15.8-3.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.9.Z:shim-0:15.8-3.el7.src"
        },
        "product_reference": "shim-0:15.8-3.el7.src",
        "relates_to_product_reference": "7Client-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-ia32-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64"
        },
        "product_reference": "shim-ia32-0:15.8-1.el7.x86_64",
        "relates_to_product_reference": "7Client-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-signed-0:15.8-1.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src"
        },
        "product_reference": "shim-signed-0:15.8-1.el7.src",
        "relates_to_product_reference": "7Client-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-unsigned-ia32-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64"
        },
        "product_reference": "shim-unsigned-ia32-0:15.8-3.el7.x86_64",
        "relates_to_product_reference": "7Client-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-unsigned-x64-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64"
        },
        "product_reference": "shim-unsigned-x64-0:15.8-3.el7.x86_64",
        "relates_to_product_reference": "7Client-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-x64-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
        },
        "product_reference": "shim-x64-0:15.8-1.el7.x86_64",
        "relates_to_product_reference": "7Client-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mokutil-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64"
        },
        "product_reference": "mokutil-0:15.8-1.el7.x86_64",
        "relates_to_product_reference": "7Server-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mokutil-debuginfo-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64"
        },
        "product_reference": "mokutil-debuginfo-0:15.8-1.el7.x86_64",
        "relates_to_product_reference": "7Server-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-0:15.8-3.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.9.Z:shim-0:15.8-3.el7.src"
        },
        "product_reference": "shim-0:15.8-3.el7.src",
        "relates_to_product_reference": "7Server-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-ia32-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64"
        },
        "product_reference": "shim-ia32-0:15.8-1.el7.x86_64",
        "relates_to_product_reference": "7Server-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-signed-0:15.8-1.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src"
        },
        "product_reference": "shim-signed-0:15.8-1.el7.src",
        "relates_to_product_reference": "7Server-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-unsigned-ia32-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64"
        },
        "product_reference": "shim-unsigned-ia32-0:15.8-3.el7.x86_64",
        "relates_to_product_reference": "7Server-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-unsigned-x64-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64"
        },
        "product_reference": "shim-unsigned-x64-0:15.8-3.el7.x86_64",
        "relates_to_product_reference": "7Server-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-x64-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
        },
        "product_reference": "shim-x64-0:15.8-1.el7.x86_64",
        "relates_to_product_reference": "7Server-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mokutil-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64"
        },
        "product_reference": "mokutil-0:15.8-1.el7.x86_64",
        "relates_to_product_reference": "7Workstation-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mokutil-debuginfo-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64"
        },
        "product_reference": "mokutil-debuginfo-0:15.8-1.el7.x86_64",
        "relates_to_product_reference": "7Workstation-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-0:15.8-3.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.9.Z:shim-0:15.8-3.el7.src"
        },
        "product_reference": "shim-0:15.8-3.el7.src",
        "relates_to_product_reference": "7Workstation-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-ia32-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64"
        },
        "product_reference": "shim-ia32-0:15.8-1.el7.x86_64",
        "relates_to_product_reference": "7Workstation-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-signed-0:15.8-1.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src"
        },
        "product_reference": "shim-signed-0:15.8-1.el7.src",
        "relates_to_product_reference": "7Workstation-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-unsigned-ia32-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64"
        },
        "product_reference": "shim-unsigned-ia32-0:15.8-3.el7.x86_64",
        "relates_to_product_reference": "7Workstation-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-unsigned-x64-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64"
        },
        "product_reference": "shim-unsigned-x64-0:15.8-3.el7.x86_64",
        "relates_to_product_reference": "7Workstation-7.9.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-x64-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
        },
        "product_reference": "shim-x64-0:15.8-1.el7.x86_64",
        "relates_to_product_reference": "7Workstation-7.9.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-40546",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241796"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn\u0027t match the format string used by it, leading to a crash under certain circumstances.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bounds read printing error messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:shim-0:15.8-3.el7.src",
          "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:shim-0:15.8-3.el7.src",
          "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
          "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40546"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241796",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241796"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40546",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40546"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40546",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40546"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-23T01:00:12+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1959"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bounds read printing error messages"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Bill Demirkapi"
          ],
          "organization": "Microsoft Security Response Center"
        }
      ],
      "cve": "CVE-2023-40547",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2023-05-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2234589"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: RCE in http boot support may lead to Secure Boot bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot\u0027s previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:shim-0:15.8-3.el7.src",
          "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:shim-0:15.8-3.el7.src",
          "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
          "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40547"
        },
        {
          "category": "external",
          "summary": "RHBZ#2234589",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2234589"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40547",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40547"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40547",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40547"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-23T01:00:12+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1959"
        },
        {
          "category": "workaround",
          "details": "If a system isn\u2019t required to boot from the network, configure the server\u2019s boot order to disable entirely or skip the network boot.",
          "product_ids": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "shim: RCE in http boot support may lead to Secure Boot bypass"
    },
    {
      "cve": "CVE-2023-40548",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241782"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:shim-0:15.8-3.el7.src",
          "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:shim-0:15.8-3.el7.src",
          "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
          "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40548"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241782",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241782"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40548",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40548"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40548",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40548"
        }
      ],
      "release_date": "2023-10-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-23T01:00:12+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1959"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems"
    },
    {
      "cve": "CVE-2023-40549",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241797"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:shim-0:15.8-3.el7.src",
          "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:shim-0:15.8-3.el7.src",
          "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
          "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40549"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241797",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241797"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40549",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40549"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40549",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40549"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-23T01:00:12+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1959"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file"
    },
    {
      "cve": "CVE-2023-40550",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-01-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2259915"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system\u0027s boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bound read in verify_buffer_sbat()",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:shim-0:15.8-3.el7.src",
          "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:shim-0:15.8-3.el7.src",
          "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
          "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40550"
        },
        {
          "category": "external",
          "summary": "RHBZ#2259915",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259915"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40550",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40550"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40550",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40550"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-23T01:00:12+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1959"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bound read in verify_buffer_sbat()"
    },
    {
      "cve": "CVE-2023-40551",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2023-07-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2259918"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system\u0027s boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: out of bounds read when parsing MZ binaries",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:shim-0:15.8-3.el7.src",
          "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:shim-0:15.8-3.el7.src",
          "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
          "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
          "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
          "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
          "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
          "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40551"
        },
        {
          "category": "external",
          "summary": "RHBZ#2259918",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259918"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40551",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40551"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40551",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40551"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-23T01:00:12+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1959"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-0:15.8-3.el7.src",
            "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-0:15.8-3.el7.src",
            "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-0:15.8-3.el7.src",
            "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64",
            "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src",
            "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64",
            "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: out of bounds read when parsing MZ binaries"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for shim is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:1902",
        "url": "https://access.redhat.com/errata/RHSA-2024:1902"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2234589",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2234589"
      },
      {
        "category": "external",
        "summary": "2241782",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241782"
      },
      {
        "category": "external",
        "summary": "2241796",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241796"
      },
      {
        "category": "external",
        "summary": "2241797",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241797"
      },
      {
        "category": "external",
        "summary": "2259915",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259915"
      },
      {
        "category": "external",
        "summary": "2259918",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259918"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1902.json"
      }
    ],
    "title": "Red Hat Security Advisory: shim security update",
    "tracking": {
      "current_release_date": "2026-03-18T02:37:42+00:00",
      "generator": {
        "date": "2026-03-18T02:37:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.3"
        }
      },
      "id": "RHSA-2024:1902",
      "initial_release_date": "2024-04-18T17:44:10+00:00",
      "revision_history": [
        {
          "date": "2024-04-18T17:44:10+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-04-18T17:44:10+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-18T02:37:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                  "product_id": "BaseOS-8.9.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:8::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-0:15.8-4.el8_9.src",
                "product": {
                  "name": "shim-0:15.8-4.el8_9.src",
                  "product_id": "shim-0:15.8-4.el8_9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim@15.8-4.el8_9?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-aa64-0:15.8-4.el8_9.aarch64",
                "product": {
                  "name": "shim-aa64-0:15.8-4.el8_9.aarch64",
                  "product_id": "shim-aa64-0:15.8-4.el8_9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-aa64@15.8-4.el8_9?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-ia32-0:15.8-4.el8_9.x86_64",
                "product": {
                  "name": "shim-ia32-0:15.8-4.el8_9.x86_64",
                  "product_id": "shim-ia32-0:15.8-4.el8_9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-ia32@15.8-4.el8_9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "shim-x64-0:15.8-4.el8_9.x86_64",
                "product": {
                  "name": "shim-x64-0:15.8-4.el8_9.x86_64",
                  "product_id": "shim-x64-0:15.8-4.el8_9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-x64@15.8-4.el8_9?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-0:15.8-4.el8_9.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src"
        },
        "product_reference": "shim-0:15.8-4.el8_9.src",
        "relates_to_product_reference": "BaseOS-8.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-aa64-0:15.8-4.el8_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64"
        },
        "product_reference": "shim-aa64-0:15.8-4.el8_9.aarch64",
        "relates_to_product_reference": "BaseOS-8.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-ia32-0:15.8-4.el8_9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64"
        },
        "product_reference": "shim-ia32-0:15.8-4.el8_9.x86_64",
        "relates_to_product_reference": "BaseOS-8.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-x64-0:15.8-4.el8_9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
        },
        "product_reference": "shim-x64-0:15.8-4.el8_9.x86_64",
        "relates_to_product_reference": "BaseOS-8.9.0.Z.MAIN"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-40546",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241796"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn\u0027t match the format string used by it, leading to a crash under certain circumstances.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bounds read printing error messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
          "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
          "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
          "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40546"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241796",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241796"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40546",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40546"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40546",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40546"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T17:44:10+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1902"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bounds read printing error messages"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Bill Demirkapi"
          ],
          "organization": "Microsoft Security Response Center"
        }
      ],
      "cve": "CVE-2023-40547",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2023-05-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2234589"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: RCE in http boot support may lead to Secure Boot bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot\u0027s previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
          "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
          "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
          "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40547"
        },
        {
          "category": "external",
          "summary": "RHBZ#2234589",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2234589"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40547",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40547"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40547",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40547"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T17:44:10+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1902"
        },
        {
          "category": "workaround",
          "details": "If a system isn\u2019t required to boot from the network, configure the server\u2019s boot order to disable entirely or skip the network boot.",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "shim: RCE in http boot support may lead to Secure Boot bypass"
    },
    {
      "cve": "CVE-2023-40548",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241782"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
          "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
          "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
          "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40548"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241782",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241782"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40548",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40548"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40548",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40548"
        }
      ],
      "release_date": "2023-10-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T17:44:10+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1902"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems"
    },
    {
      "cve": "CVE-2023-40549",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241797"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
          "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
          "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
          "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40549"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241797",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241797"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40549",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40549"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40549",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40549"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T17:44:10+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1902"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file"
    },
    {
      "cve": "CVE-2023-40550",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-01-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2259915"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system\u0027s boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bound read in verify_buffer_sbat()",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
          "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
          "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
          "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40550"
        },
        {
          "category": "external",
          "summary": "RHBZ#2259915",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259915"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40550",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40550"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40550",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40550"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T17:44:10+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1902"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bound read in verify_buffer_sbat()"
    },
    {
      "cve": "CVE-2023-40551",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2023-07-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2259918"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system\u0027s boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: out of bounds read when parsing MZ binaries",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
          "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
          "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
          "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40551"
        },
        {
          "category": "external",
          "summary": "RHBZ#2259918",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259918"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40551",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40551"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40551",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40551"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T17:44:10+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1902"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: out of bounds read when parsing MZ binaries"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for shim is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:1902",
        "url": "https://access.redhat.com/errata/RHSA-2024:1902"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2234589",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2234589"
      },
      {
        "category": "external",
        "summary": "2241782",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241782"
      },
      {
        "category": "external",
        "summary": "2241796",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241796"
      },
      {
        "category": "external",
        "summary": "2241797",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241797"
      },
      {
        "category": "external",
        "summary": "2259915",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259915"
      },
      {
        "category": "external",
        "summary": "2259918",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259918"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1902.json"
      }
    ],
    "title": "Red Hat Security Advisory: shim security update",
    "tracking": {
      "current_release_date": "2024-11-24T14:20:20+00:00",
      "generator": {
        "date": "2024-11-24T14:20:20+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2024:1902",
      "initial_release_date": "2024-04-18T17:44:10+00:00",
      "revision_history": [
        {
          "date": "2024-04-18T17:44:10+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-04-18T17:44:10+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-24T14:20:20+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                  "product_id": "BaseOS-8.9.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:8::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-0:15.8-4.el8_9.src",
                "product": {
                  "name": "shim-0:15.8-4.el8_9.src",
                  "product_id": "shim-0:15.8-4.el8_9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim@15.8-4.el8_9?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-aa64-0:15.8-4.el8_9.aarch64",
                "product": {
                  "name": "shim-aa64-0:15.8-4.el8_9.aarch64",
                  "product_id": "shim-aa64-0:15.8-4.el8_9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-aa64@15.8-4.el8_9?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-ia32-0:15.8-4.el8_9.x86_64",
                "product": {
                  "name": "shim-ia32-0:15.8-4.el8_9.x86_64",
                  "product_id": "shim-ia32-0:15.8-4.el8_9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-ia32@15.8-4.el8_9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "shim-x64-0:15.8-4.el8_9.x86_64",
                "product": {
                  "name": "shim-x64-0:15.8-4.el8_9.x86_64",
                  "product_id": "shim-x64-0:15.8-4.el8_9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-x64@15.8-4.el8_9?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-0:15.8-4.el8_9.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src"
        },
        "product_reference": "shim-0:15.8-4.el8_9.src",
        "relates_to_product_reference": "BaseOS-8.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-aa64-0:15.8-4.el8_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64"
        },
        "product_reference": "shim-aa64-0:15.8-4.el8_9.aarch64",
        "relates_to_product_reference": "BaseOS-8.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-ia32-0:15.8-4.el8_9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64"
        },
        "product_reference": "shim-ia32-0:15.8-4.el8_9.x86_64",
        "relates_to_product_reference": "BaseOS-8.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-x64-0:15.8-4.el8_9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
        },
        "product_reference": "shim-x64-0:15.8-4.el8_9.x86_64",
        "relates_to_product_reference": "BaseOS-8.9.0.Z.MAIN"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-40546",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241796"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn\u0027t match the format string used by it, leading to a crash under certain circumstances.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bounds read printing error messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
          "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
          "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
          "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40546"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241796",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241796"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40546",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40546"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40546",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40546"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T17:44:10+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1902"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bounds read printing error messages"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Bill Demirkapi"
          ],
          "organization": "Microsoft Security Response Center"
        }
      ],
      "cve": "CVE-2023-40547",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2023-05-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2234589"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: RCE in http boot support may lead to Secure Boot bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot\u0027s previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
          "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
          "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
          "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40547"
        },
        {
          "category": "external",
          "summary": "RHBZ#2234589",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2234589"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40547",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40547"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40547",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40547"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T17:44:10+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1902"
        },
        {
          "category": "workaround",
          "details": "If a system isn\u2019t required to boot from the network, configure the server\u2019s boot order to disable entirely or skip the network boot.",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "shim: RCE in http boot support may lead to Secure Boot bypass"
    },
    {
      "cve": "CVE-2023-40548",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241782"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
          "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
          "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
          "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40548"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241782",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241782"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40548",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40548"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40548",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40548"
        }
      ],
      "release_date": "2023-10-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T17:44:10+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1902"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems"
    },
    {
      "cve": "CVE-2023-40549",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241797"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
          "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
          "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
          "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40549"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241797",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241797"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40549",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40549"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40549",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40549"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T17:44:10+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1902"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file"
    },
    {
      "cve": "CVE-2023-40550",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-01-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2259915"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system\u0027s boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bound read in verify_buffer_sbat()",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
          "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
          "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
          "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40550"
        },
        {
          "category": "external",
          "summary": "RHBZ#2259915",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259915"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40550",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40550"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40550",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40550"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T17:44:10+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1902"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bound read in verify_buffer_sbat()"
    },
    {
      "cve": "CVE-2023-40551",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2023-07-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2259918"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system\u0027s boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: out of bounds read when parsing MZ binaries",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
          "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
          "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
          "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40551"
        },
        {
          "category": "external",
          "summary": "RHBZ#2259918",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259918"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40551",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40551"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40551",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40551"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-18T17:44:10+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1902"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src",
            "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64",
            "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64",
            "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: out of bounds read when parsing MZ binaries"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for shim is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.2 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:1834",
        "url": "https://access.redhat.com/errata/RHSA-2024:1834"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2234589",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2234589"
      },
      {
        "category": "external",
        "summary": "2241782",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241782"
      },
      {
        "category": "external",
        "summary": "2241796",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241796"
      },
      {
        "category": "external",
        "summary": "2241797",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241797"
      },
      {
        "category": "external",
        "summary": "2259915",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259915"
      },
      {
        "category": "external",
        "summary": "2259918",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259918"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1834.json"
      }
    ],
    "title": "Red Hat Security Advisory: shim security update",
    "tracking": {
      "current_release_date": "2026-03-18T02:37:41+00:00",
      "generator": {
        "date": "2026-03-18T02:37:41+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.3"
        }
      },
      "id": "RHSA-2024:1834",
      "initial_release_date": "2024-04-16T13:38:02+00:00",
      "revision_history": [
        {
          "date": "2024-04-16T13:38:02+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-04-16T13:38:02+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-18T02:37:41+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
                  "product_id": "BaseOS-8.2.0.Z.AUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_aus:8.2::baseos"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS E4S (v. 8.2)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS E4S (v. 8.2)",
                  "product_id": "BaseOS-8.2.0.Z.E4S",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_e4s:8.2::baseos"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS TUS (v. 8.2)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS TUS (v. 8.2)",
                  "product_id": "BaseOS-8.2.0.Z.TUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_tus:8.2::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-0:15.8-2.el8_2.src",
                "product": {
                  "name": "shim-0:15.8-2.el8_2.src",
                  "product_id": "shim-0:15.8-2.el8_2.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim@15.8-2.el8_2?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-ia32-0:15.8-2.el8_2.x86_64",
                "product": {
                  "name": "shim-ia32-0:15.8-2.el8_2.x86_64",
                  "product_id": "shim-ia32-0:15.8-2.el8_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-ia32@15.8-2.el8_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "shim-x64-0:15.8-2.el8_2.x86_64",
                "product": {
                  "name": "shim-x64-0:15.8-2.el8_2.x86_64",
                  "product_id": "shim-x64-0:15.8-2.el8_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/shim-x64@15.8-2.el8_2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-0:15.8-2.el8_2.src as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src"
        },
        "product_reference": "shim-0:15.8-2.el8_2.src",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-ia32-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64"
        },
        "product_reference": "shim-ia32-0:15.8-2.el8_2.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-x64-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64"
        },
        "product_reference": "shim-x64-0:15.8-2.el8_2.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-0:15.8-2.el8_2.src as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src"
        },
        "product_reference": "shim-0:15.8-2.el8_2.src",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-ia32-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64"
        },
        "product_reference": "shim-ia32-0:15.8-2.el8_2.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-x64-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64"
        },
        "product_reference": "shim-x64-0:15.8-2.el8_2.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-0:15.8-2.el8_2.src as a component of Red Hat Enterprise Linux BaseOS TUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src"
        },
        "product_reference": "shim-0:15.8-2.el8_2.src",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-ia32-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64"
        },
        "product_reference": "shim-ia32-0:15.8-2.el8_2.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-x64-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
        },
        "product_reference": "shim-x64-0:15.8-2.el8_2.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.TUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-40546",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241796"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn\u0027t match the format string used by it, leading to a crash under certain circumstances.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bounds read printing error messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40546"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241796",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241796"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40546",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40546"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40546",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40546"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-16T13:38:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1834"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bounds read printing error messages"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Bill Demirkapi"
          ],
          "organization": "Microsoft Security Response Center"
        }
      ],
      "cve": "CVE-2023-40547",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2023-05-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2234589"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: RCE in http boot support may lead to Secure Boot bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot\u0027s previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40547"
        },
        {
          "category": "external",
          "summary": "RHBZ#2234589",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2234589"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40547",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40547"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40547",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40547"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-16T13:38:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1834"
        },
        {
          "category": "workaround",
          "details": "If a system isn\u2019t required to boot from the network, configure the server\u2019s boot order to disable entirely or skip the network boot.",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "shim: RCE in http boot support may lead to Secure Boot bypass"
    },
    {
      "cve": "CVE-2023-40548",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241782"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40548"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241782",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241782"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40548",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40548"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40548",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40548"
        }
      ],
      "release_date": "2023-10-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-16T13:38:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1834"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems"
    },
    {
      "cve": "CVE-2023-40549",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2023-10-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2241797"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40549"
        },
        {
          "category": "external",
          "summary": "RHBZ#2241797",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241797"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40549",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40549"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40549",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40549"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-16T13:38:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1834"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation for this issue.",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file"
    },
    {
      "cve": "CVE-2023-40550",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-01-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2259915"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system\u0027s boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: Out-of-bound read in verify_buffer_sbat()",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40550"
        },
        {
          "category": "external",
          "summary": "RHBZ#2259915",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259915"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40550",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40550"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40550",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40550"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-16T13:38:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1834"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: Out-of-bound read in verify_buffer_sbat()"
    },
    {
      "cve": "CVE-2023-40551",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2023-07-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2259918"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system\u0027s boot phase.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shim: out of bounds read when parsing MZ binaries",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
          "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
          "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40551"
        },
        {
          "category": "external",
          "summary": "RHBZ#2259918",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259918"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40551",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40551"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40551",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40551"
        }
      ],
      "release_date": "2024-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-16T13:38:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1834"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src",
            "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64",
            "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "shim: out of bounds read when parsing MZ binaries"
    }
  ]
}