{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be available in the upcoming releases.\n\nNotice: LabX Standard was formerly known as LabX Cloud Local.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "The identified vulnerabilities may expose the system to risks such as denial\u2011of\u2011service attacks, authentication bypass, authorization weaknesses, and potential remote code execution.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "For Vulnerabilities CVE-2023-29331, CVE-2024-0056, CVE-2021-24112, CVE-2023-36414, CVE-2024-43483, CVE-2026-24737, CVE-2025-46817, CVE-2026-22036, CVE-2025-68154, CVE-2026-2391, CVE-2026-26130, CVE-2026-26127, CVE-2026-21218, CVE-2025-68121, CVE-2025-15281, CVE-2018-15727, CVE-2025-9230 update all LabX Standard installations to 21.4.23 to address and resolve the vulnerabilities.",
        "title": "Remediation"
      },
      {
        "category": "legal_disclaimer",
        "text": "Your use of the information on this document or materials linked from this document is at your own risk. METTLER TOLEDO makes reasonable efforts to ensure the accuracy of the information but does not grant any warranty, express or implied, including warranties of merchantability or fitness for a particular purpose. To the extent permitted by applicable law, METTLER TOLEDO excludes liability for any loss, claim, expense or damage arising from or related to the statements in this document. METTLER TOLEDO reserves the right to change or update this document at any time.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@mt.com",
      "name": "Mettler-Toledo GmbH",
      "namespace": "https://www.mt.com"
    },
    "references": [
      {
        "category": "external",
        "summary": "Product security website of METTLER TOLEDO",
        "url": "https://www.mt.com/ph/en/home/site_content/product-security.html"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for METTLER TOLEDO",
        "url": "https://certvde.com/en/advisories/vendor/mettler-toledo/"
      },
      {
        "category": "self",
        "summary": "VDE-2026-064: METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.3 - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2026-064/"
      },
      {
        "category": "self",
        "summary": "VDE-2026-064: METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.3 - CSAF",
        "url": "https://mettler-toledo.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-064.json"
      }
    ],
    "title": "METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.3",
    "tracking": {
      "aliases": [
        "VDE-2026-064"
      ],
      "current_release_date": "2026-06-09T10:00:00.000Z",
      "generator": {
        "date": "2026-06-08T11:42:39.202Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.44"
        }
      },
      "id": "VDE-2026-064",
      "initial_release_date": "2026-06-09T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-06-09T10:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial revision"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "21.3.22",
                    "product": {
                      "name": "LabX Standard 21.3.22",
                      "product_id": "CSAFPID-51000",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:mettler_toledo:labx_standard:21.3.22:*:*:*:*:*:*:*"
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "21.4.23",
                    "product": {
                      "name": "LabX Standard 21.4.23",
                      "product_id": "CSAFPID-52002",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:mettler_toledo:labx_standard:21.4.23:*:*:*:*:*:*:*"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "LabX Standard"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "METTLER TOLEDO"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-29331",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "description",
          "text": ".NET Framework, and Visual Studio Denial of Service Vulnerability",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": ".NET, .NET Framework, and Visual Studio Denial of Service Vulnerability"
    },
    {
      "cve": "CVE-2024-0056",
      "cwe": {
        "id": "CWE-319",
        "name": "Cleartext Transmission of Sensitive Information"
      },
      "notes": [
        {
          "category": "description",
          "text": "Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.7,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "CHANGED",
            "temporalScore": 8.7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": "Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability"
    },
    {
      "cve": "CVE-2021-24112",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": ".NET Core Remote Code Execution Vulnerability",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.1,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 8.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": ".NET Core Remote Code Execution Vulnerability"
    },
    {
      "cve": "CVE-2023-36414",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "Azure Identity SDK Remote Code Execution Vulnerability",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": "Azure Identity SDK Remote Code Execution Vulnerability"
    },
    {
      "cve": "CVE-2024-43483",
      "cwe": {
        "id": "CWE-407",
        "name": "Inefficient Algorithmic Complexity"
      },
      "notes": [
        {
          "category": "description",
          "text": ".NET, .NET Framework, and Visual Studio Denial of Service Vulnerability",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": ".NET, .NET Framework, and Visual Studio Denial of Service Vulnerability"
    },
    {
      "cve": "CVE-2026-24737",
      "cwe": {
        "id": "CWE-116",
        "name": "Improper Encoding or Escaping of Output"
      },
      "notes": [
        {
          "category": "description",
          "text": "jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.1,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 8.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": "jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution"
    },
    {
      "cve": "CVE-2025-46817",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": "Lua library commands may lead to integer overflow and potential RCE"
    },
    {
      "cve": "CVE-2026-22036",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "description",
          "text": "Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": " Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion"
    },
    {
      "cve": "CVE-2025-68154",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.1,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 8.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": "Command Injection in fsSize() on Windows"
    },
    {
      "cve": "CVE-2026-2391",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284). ### Details When the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `[\u0027a\u0027, \u0027b\u0027, \u0027c\u0027]`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": "qs\u0027s arrayLimit bypass in comma parsing allows denial of service"
    },
    {
      "cve": "CVE-2025-69419",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service. The OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes, but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is added to the output length without validation, causing the length to become negative. The subsequent trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer. The vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue, PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one zero byte write before the allocated buffer. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-52002"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "none_available",
          "details": "This vulnerability will be fixed in the upcoming releases",
          "product_ids": [
            "CSAFPID-52002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.4,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.4,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-52002"
          ]
        }
      ],
      "title": "Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion"
    },
    {
      "cve": "CVE-2026-0915",
      "cwe": {
        "id": "CWE-908",
        "name": "Use of Uninitialized Resource"
      },
      "notes": [
        {
          "category": "description",
          "text": "Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library\u0027s DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-52002"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "none_available",
          "details": "This vulnerability will be fixed in the upcoming releases",
          "product_ids": [
            "CSAFPID-52002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-52002"
          ]
        }
      ],
      "title": "getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler"
    },
    {
      "cve": "CVE-2026-26130",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "description",
          "text": "Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": "ASP.NET Core Denial of Service Vulnerability"
    },
    {
      "cve": "CVE-2026-26127",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "description",
          "text": "Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": ".NET Denial of Service Vulnerability"
    },
    {
      "cve": "CVE-2026-21218",
      "cwe": {
        "id": "CWE-166",
        "name": "Improper Handling of Missing Special Element"
      },
      "notes": [
        {
          "category": "description",
          "text": "Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": ".NET Spoofing Vulnerability"
    },
    {
      "cve": "CVE-2025-68121",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 10,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 10,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": "Unexpected session resumption in crypto/tls"
    },
    {
      "cve": "CVE-2025-15281",
      "cwe": {
        "id": "CWE-908",
        "name": "Use of Uninitialized Resource"
      },
      "notes": [
        {
          "category": "description",
          "text": "Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": "wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory"
    },
    {
      "cve": "CVE-2018-15727",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "description",
          "text": "Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid \"remember me\" cookie knowing only a username of an LDAP or OAuth user.",
          "title": "CVE Decription"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": "Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid \"remember me\" cookie knowing only a username of an LDAP or OAuth user."
    },
    {
      "cve": "CVE-2025-15467",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-52002"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "none_available",
          "details": "This vulnerability will be fixed in the upcoming releases",
          "product_ids": [
            "CSAFPID-52002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-52002"
          ]
        }
      ],
      "title": "Stack buffer overflow in CMS (Auth)EnvelopedData parsing"
    },
    {
      "cve": "CVE-2025-9230",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "description",
          "text": "An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51000"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to LabX Standard v21.4.23",
          "product_ids": [
            "CSAFPID-51000"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51000"
          ]
        }
      ],
      "title": "Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap"
    },
    {
      "cve": "CVE-2025-58187",
      "cwe": {
        "id": "CWE-407",
        "name": "Inefficient Algorithmic Complexity"
      },
      "notes": [
        {
          "category": "description",
          "text": "Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-52002"
        ],
        "recommended": [
          "CSAFPID-52002"
        ]
      },
      "remediations": [
        {
          "category": "none_available",
          "details": "This vulnerability will be fixed in the upcoming releases",
          "product_ids": [
            "CSAFPID-52002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-52002"
          ]
        }
      ],
      "title": "Quadratic complexity when checking name constraints in crypto/x509"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "OpenSSL ist eine im Quelltext frei verf\u00fcgbare Bibliothek, die Secure Sockets Layer (SSL) und Transport Layer Security (TLS) implementiert.\r\nLibreSSL ist eine im Quelltext frei verf\u00fcgbare Bibliothek, die Secure Sockets Layer (SSL) und Transport Layer Security (TLS) implementiert.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenSSL und LibreSSL ausnutzen, um potentiell beliebigen Code auszuf\u00fchren, einen Denial of Service-Zustand zu verursachen und vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-2166 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2166.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-2166 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2166"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:23449 vom 2025-12-17",
        "url": "https://access.redhat.com/errata/RHSA-2025:23449"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:23209 vom 2025-12-15",
        "url": "https://access.redhat.com/errata/RHSA-2025:23209"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:23202 vom 2025-12-15",
        "url": "https://access.redhat.com/errata/RHSA-2025:23202"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:23204 vom 2025-12-15",
        "url": "https://access.redhat.com/errata/RHSA-2025:23204"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:23205 vom 2025-12-15",
        "url": "https://access.redhat.com/errata/RHSA-2025:23205"
      },
      {
        "category": "external",
        "summary": "OpenSSL Vulnerabilities vom 2025-09-30",
        "url": "https://openssl-library.org/news/vulnerabilities/"
      },
      {
        "category": "external",
        "summary": "OpenSSL Security Advisory vom 2025-09-30",
        "url": "https://openssl-library.org/news/secadv/20250930.txt"
      },
      {
        "category": "external",
        "summary": "LibreSSL 4.0.1 Release Notes vom 2025-09-30",
        "url": "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.0.1-relnotes.txt"
      },
      {
        "category": "external",
        "summary": "LibreSSL 4.1.1 Release Notes vom 2025-09-30",
        "url": "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.1.1-relnotes.txt"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:03443-1 vom 2025-09-30",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-September/022748.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:03442-1 vom 2025-09-30",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-September/022749.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:03441-1 vom 2025-09-30",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-September/022750.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:03440-1 vom 2025-09-30",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-September/022751.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:03439-1 vom 2025-09-30",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-September/022752.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:03438-1 vom 2025-09-30",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-September/022753.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:03437-1 vom 2025-09-30",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-September/022755.html"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-7786-1 vom 2025-09-30",
        "url": "https://ubuntu.com/security/notices/USN-7786-1"
      },
      {
        "category": "external",
        "summary": "FreeBSD Security Advisory FREEBSD-SA-25:08.OPENSSL vom 2025-09-30",
        "url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-25:08.openssl.asc"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-6015 vom 2025-10-01",
        "url": "https://lists.debian.org/debian-security-announce/2025/msg00181.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4321 vom 2025-10-03",
        "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2025-E6F76D56FC vom 2025-10-06",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2025-e6f76d56fc"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:03464-1 vom 2025-10-07",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-October/022766.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:03463-1 vom 2025-10-07",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-October/022767.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:03522-1 vom 2025-10-10",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HO37ZJ4KSDOK52BA22GLEUYWEU52C22X/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:03523-1 vom 2025-10-10",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-October/022811.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:03586-1 vom 2025-10-13",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/W7KVSY3I4TH7CCDGE47EBT7FT7ZHC4V5/"
      },
      {
        "category": "external",
        "summary": "IGEL Security Notice ISN-2025-43 vom 2025-10-13",
        "url": "https://kb.igel.com/en/security-safety/current/isn-2025-43-openssl-vulnerability"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2025-3022 vom 2025-10-15",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2-2025-3022.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2025-3034 vom 2025-10-15",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2-2025-3034.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2025-3033 vom 2025-10-15",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2-2025-3033.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2OPENSSL-SNAPSAFE-2025-008 vom 2025-10-14",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2OPENSSL-SNAPSAFE-2025-008.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:03632-1 vom 2025-10-17",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/V6Z2I7RMKLOGDSLKDAHHV7HBNFSLSMGJ/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:03635-1 vom 2025-10-17",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-October/022924.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:03630-1 vom 2025-10-17",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-October/022921.html"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2025-4D34C066A1 vom 2025-10-20",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2025-4d34c066a1"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:3758-1 vom 2025-10-23",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FNZ57TWUAFLSYOWFLCQJ4G3DJKUC7N6D/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:20867-1 vom 2025-10-27",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-October/023063.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:20896-1 vom 2025-10-30",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-October/023118.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:20910-1 vom 2025-10-30",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-October/023105.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:3917-1 vom 2025-11-03",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023142.html"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2025-390 vom 2025-11-05",
        "url": "https://www.dell.com/support/kbdoc/000385230"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:21174 vom 2025-11-13",
        "url": "https://access.redhat.com/errata/RHSA-2025:21174"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:21248 vom 2025-11-13",
        "url": "https://access.redhat.com/errata/RHSA-2025:21248"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:21255 vom 2025-11-13",
        "url": "https://access.redhat.com/errata/RHSA-2025:21255"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:21562 vom 2025-11-17",
        "url": "https://access.redhat.com/errata/RHSA-2025:21562"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:4126-1 vom 2025-11-18",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023297.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7250234 vom 2025-11-19",
        "url": "https://www.ibm.com/support/pages/node/7250234"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:21994 vom 2025-11-24",
        "url": "https://access.redhat.com/errata/RHSA-2025:21994"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2025:21248 vom 2025-11-25",
        "url": "https://errata.build.resf.org/RLSA-2025:21248"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-28011 vom 2025-11-26",
        "url": "https://linux.oracle.com/errata/ELSA-2025-28011.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-21255 vom 2025-11-26",
        "url": "http://linux.oracle.com/errata/ELSA-2025-21255.html"
      },
      {
        "category": "external",
        "summary": "Meinberg Security Advisory MBGSA-2025.06 vom 2025-11-27",
        "url": "https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2025-06-lantime-firmware-v7-10-004.htm"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:22428 vom 2025-12-01",
        "url": "https://access.redhat.com/errata/RHSA-2025:22428"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-28020 vom 2025-12-01",
        "url": "https://linux.oracle.com/errata/ELSA-2025-28020.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:22529 vom 2025-12-02",
        "url": "https://access.redhat.com/errata/RHSA-2025:22529"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2025-8E15323AF1 vom 2025-12-03",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-8e15323af1"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-21248 vom 2025-12-03",
        "url": "https://linux.oracle.com/errata/ELSA-2025-21248.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:22794 vom 2025-12-08",
        "url": "https://access.redhat.com/errata/RHSA-2025:22794"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:22868 vom 2025-12-08",
        "url": "https://access.redhat.com/errata/RHSA-2025:22868"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-28041 vom 2025-12-09",
        "url": "https://linux.oracle.com/errata/ELSA-2025-28041.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7254361 vom 2025-12-11",
        "url": "https://aix.software.ibm.com/aix/efixes/security/openssl_advisory45.asc"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:23079 vom 2025-12-10",
        "url": "https://access.redhat.com/errata/RHSA-2025:23079"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:23078 vom 2025-12-10",
        "url": "https://access.redhat.com/errata/RHSA-2025:23078"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:23080 vom 2025-12-10",
        "url": "https://access.redhat.com/errata/RHSA-2025:23080"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7254313 vom 2025-12-10",
        "url": "https://www.ibm.com/support/pages/node/7254313"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2025:20164-1 vom 2025-12-17",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FI7WKQF75XQ7WHDVEL25P4FK5MLALDSJ/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:21213-1 vom 2025-12-18",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023595.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:21224-1 vom 2025-12-18",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023587.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7255930 vom 2025-12-29",
        "url": "https://www.ibm.com/support/pages/node/7255930"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2025-3104 vom 2026-01-05",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2-2025-3104.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:0337 vom 2026-01-08",
        "url": "https://access.redhat.com/errata/RHSA-2026:0337"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-0337 vom 2026-01-09",
        "url": "https://linux.oracle.com/errata/ELSA-2026-0337.html"
      },
      {
        "category": "external",
        "summary": "Progress Knowledge Base vom 2026-01-08",
        "url": "https://community.progress.com/s/article/Is-WS-FTP-Server-version-2025-vulnerable-to-CVE-2025-9232"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:0337 vom 2026-01-14",
        "url": "https://errata.build.resf.org/RLSA-2026:0337"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:0420 vom 2026-01-14",
        "url": "https://access.redhat.com/errata/RHSA-2026:0420"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:0602 vom 2026-01-14",
        "url": "https://access.redhat.com/errata/RHSA-2026:0602"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-50008 vom 2026-01-15",
        "url": "https://linux.oracle.com/errata/ELSA-2026-50008.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:0714 vom 2026-01-15",
        "url": "https://access.redhat.com/errata/RHSA-2026:0714"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:0332 vom 2026-01-15",
        "url": "https://access.redhat.com/errata/RHSA-2026:0332"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:0794 vom 2026-01-19",
        "url": "https://access.redhat.com/errata/RHSA-2026:0794"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:0887 vom 2026-01-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:0887"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:0950 vom 2026-01-22",
        "url": "https://access.redhat.com/errata/RHSA-2026:0950"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:0702 vom 2026-01-22",
        "url": "https://access.redhat.com/errata/RHSA-2026:0702"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:0674 vom 2026-01-22",
        "url": "https://access.redhat.com/errata/RHSA-2026:0674"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:1349 vom 2026-01-27",
        "url": "https://access.redhat.com/errata/RHSA-2026:1349"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:1475 vom 2026-01-28",
        "url": "https://access.redhat.com/errata/RHSA-2026:1475"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:1652 vom 2026-02-02",
        "url": "https://access.redhat.com/errata/RHSA-2026:1652"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-50080 vom 2026-01-30",
        "url": "https://linux.oracle.com/errata/ELSA-2026-50080.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-50081 vom 2026-01-30",
        "url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:1720 vom 2026-02-02",
        "url": "https://access.redhat.com/errata/RHSA-2026:1720"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-50077 vom 2026-02-02",
        "url": "https://linux.oracle.com/errata/ELSA-2026-50077.html"
      },
      {
        "category": "external",
        "summary": "F5 Security Advisory K000159887 vom 2026-02-06",
        "url": "https://my.f5.com/manage/s/article/K000159887"
      },
      {
        "category": "external",
        "summary": "SolarWinds Platform 2026.1 release notes vom 2026-02-10",
        "url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2026-1_release_notes.htm"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-1720 vom 2026-02-13",
        "url": "https://linux.oracle.com/errata/ELSA-2026-1720.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2776 vom 2026-02-17",
        "url": "https://access.redhat.com/errata/RHSA-2026:2776"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2771 vom 2026-02-17",
        "url": "https://access.redhat.com/errata/RHSA-2026:2771"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:20418-1 vom 2026-02-17",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024331.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-2776 vom 2026-02-17",
        "url": "https://linux.oracle.com/errata/ELSA-2026-2776.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-50114 vom 2026-02-17",
        "url": "https://linux.oracle.com/errata/ELSA-2026-50114.html"
      },
      {
        "category": "external",
        "summary": "Splunk Security Advisory SVD-2026-0210 vom 2026-02-18",
        "url": "https://advisory.splunk.com//advisories/SVD-2026-0210"
      },
      {
        "category": "external",
        "summary": "Splunk Security Advisory SVD-2026-0211 vom 2026-02-18",
        "url": "https://advisory.splunk.com//advisories/SVD-2026-0211"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2994 vom 2026-02-23",
        "url": "https://access.redhat.com/errata/RHSA-2026:2994"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2995 vom 2026-02-23",
        "url": "https://access.redhat.com/errata/RHSA-2026:2995"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-3042 vom 2026-02-24",
        "url": "https://linux.oracle.com/errata/ELSA-2026-3042.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:3164 vom 2026-02-24",
        "url": "https://access.redhat.com/errata/RHSA-2026:3164"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:2776 vom 2026-02-24",
        "url": "https://errata.build.resf.org/RLSA-2026:2776"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:10237-1 vom 2026-02-24",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4WRV4ISEUKTVWATBUIO2SUY7JFPFBQ7F/"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2974 vom 2026-02-26",
        "url": "https://access.redhat.com/errata/RHSA-2026:2974"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-50131 vom 2026-02-27",
        "url": "https://linux.oracle.com/errata/ELSA-2026-50131.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:3462 vom 2026-02-27",
        "url": "https://access.redhat.com/errata/RHSA-2026:3462"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:3461 vom 2026-02-27",
        "url": "https://access.redhat.com/errata/RHSA-2026:3461"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:3415 vom 2026-03-05",
        "url": "https://access.redhat.com/errata/RHSA-2026:3415"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:20542-1 vom 2026-03-05",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024594.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:20607-1 vom 2026-03-05",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024609.html"
      },
      {
        "category": "external",
        "summary": "Xerox Security Bulletin XRX26-009",
        "url": "https://security.business.xerox.com/wp-content/uploads/2026/03/Xerox-Security-Bulletin-XRX26-009-for-Xerox-FreeFlow-Print-Server-v9.pdf"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:3861 vom 2026-03-12",
        "url": "https://access.redhat.com/errata/RHSA-2026:3861"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7268146 vom 2026-03-31",
        "url": "https://www.ibm.com/support/pages/node/7268146"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7270407 vom 2026-04-22",
        "url": "https://www.ibm.com/support/pages/node/7270407"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:21544-1 vom 2026-05-11",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-May/025974.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:18320 vom 2026-05-19",
        "url": "https://access.redhat.com/errata/RHSA-2026:18320"
      }
    ],
    "source_lang": "en-US",
    "title": "OpenSSL und LibreSSL: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-05-19T22:00:00.000+00:00",
      "generator": {
        "date": "2026-05-20T08:32:09.912+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2025-2166",
      "initial_release_date": "2025-09-30T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-09-30T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-10-01T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2025-10-05T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2025-10-06T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2025-10-09T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2025-10-12T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2025-10-13T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von IGEL aufgenommen"
        },
        {
          "date": "2025-10-14T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2025-10-19T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2025-10-20T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Fedora aufgenommen"
        },
        {
          "date": "2025-10-23T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2025-10-27T23:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2025-10-30T23:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2025-11-03T23:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2025-11-04T23:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2025-11-12T23:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-11-17T23:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-11-18T23:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2025-11-19T23:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-11-24T23:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-11-25T23:00:00.000+00:00",
          "number": "21",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2025-11-26T23:00:00.000+00:00",
          "number": "22",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2025-11-27T23:00:00.000+00:00",
          "number": "23",
          "summary": "Neue Updates von Meinberg aufgenommen"
        },
        {
          "date": "2025-12-01T23:00:00.000+00:00",
          "number": "24",
          "summary": "Neue Updates von Red Hat und Oracle Linux aufgenommen"
        },
        {
          "date": "2025-12-03T23:00:00.000+00:00",
          "number": "25",
          "summary": "Neue Updates von Fedora und Oracle Linux aufgenommen"
        },
        {
          "date": "2025-12-07T23:00:00.000+00:00",
          "number": "26",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-12-08T23:00:00.000+00:00",
          "number": "27",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-12-09T23:00:00.000+00:00",
          "number": "28",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2025-12-10T23:00:00.000+00:00",
          "number": "29",
          "summary": "Neue Updates von IBM und Red Hat aufgenommen"
        },
        {
          "date": "2025-12-15T23:00:00.000+00:00",
          "number": "30",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-12-16T23:00:00.000+00:00",
          "number": "31",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-12-17T23:00:00.000+00:00",
          "number": "32",
          "summary": "Neue Updates von openSUSE aufgenommen"
        },
        {
          "date": "2025-12-18T23:00:00.000+00:00",
          "number": "33",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2025-12-22T23:00:00.000+00:00",
          "number": "34",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2025-12-29T23:00:00.000+00:00",
          "number": "35",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-01-05T23:00:00.000+00:00",
          "number": "36",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2026-01-08T23:00:00.000+00:00",
          "number": "37",
          "summary": "Neue Updates von Red Hat aufgenommen; Progress WS_FTP nicht betroffen"
        },
        {
          "date": "2026-01-13T23:00:00.000+00:00",
          "number": "38",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
        },
        {
          "date": "2026-01-14T23:00:00.000+00:00",
          "number": "39",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-01-15T23:00:00.000+00:00",
          "number": "40",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-01-18T23:00:00.000+00:00",
          "number": "41",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-01-20T23:00:00.000+00:00",
          "number": "42",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-01-21T23:00:00.000+00:00",
          "number": "43",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-01-22T23:00:00.000+00:00",
          "number": "44",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-01-27T23:00:00.000+00:00",
          "number": "45",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-02-01T23:00:00.000+00:00",
          "number": "46",
          "summary": "Neue Updates von Red Hat und Oracle Linux aufgenommen"
        },
        {
          "date": "2026-02-02T23:00:00.000+00:00",
          "number": "47",
          "summary": "Neue Updates von Red Hat und Oracle Linux aufgenommen"
        },
        {
          "date": "2026-02-08T23:00:00.000+00:00",
          "number": "48",
          "summary": "Neue Updates von F5 aufgenommen"
        },
        {
          "date": "2026-02-09T23:00:00.000+00:00",
          "number": "49",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2026-02-12T23:00:00.000+00:00",
          "number": "50",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2026-02-16T23:00:00.000+00:00",
          "number": "51",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-02-17T23:00:00.000+00:00",
          "number": "52",
          "summary": "Neue Updates von Red Hat, SUSE und Oracle Linux aufgenommen"
        },
        {
          "date": "2026-02-18T23:00:00.000+00:00",
          "number": "53",
          "summary": "Neue Updates von Splunk-SVD aufgenommen"
        },
        {
          "date": "2026-02-23T23:00:00.000+00:00",
          "number": "54",
          "summary": "Neue Updates von Red Hat und Oracle Linux aufgenommen"
        },
        {
          "date": "2026-02-24T23:00:00.000+00:00",
          "number": "55",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation und openSUSE aufgenommen"
        },
        {
          "date": "2026-02-26T23:00:00.000+00:00",
          "number": "56",
          "summary": "Neue Updates von Red Hat und Oracle Linux aufgenommen"
        },
        {
          "date": "2026-03-01T23:00:00.000+00:00",
          "number": "57",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-03-04T23:00:00.000+00:00",
          "number": "58",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-03-05T23:00:00.000+00:00",
          "number": "59",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-03-08T23:00:00.000+00:00",
          "number": "60",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2026-03-11T23:00:00.000+00:00",
          "number": "61",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-03-31T22:00:00.000+00:00",
          "number": "62",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-04-22T22:00:00.000+00:00",
          "number": "63",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-05-10T22:00:00.000+00:00",
          "number": "64",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-05-19T22:00:00.000+00:00",
          "number": "65",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "65"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Appliance \u003c5.32.00.18",
                "product": {
                  "name": "Dell Secure Connect Gateway Appliance \u003c5.32.00.18",
                  "product_id": "T048301"
                }
              },
              {
                "category": "product_version",
                "name": "Appliance 5.32.00.18",
                "product": {
                  "name": "Dell Secure Connect Gateway Appliance 5.32.00.18",
                  "product_id": "T048301-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:dell:secure_connect_gateway:appliance__5.32.00.18"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Secure Connect Gateway"
          }
        ],
        "category": "vendor",
        "name": "Dell"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "F5 BIG-IP",
            "product": {
              "name": "F5 BIG-IP",
              "product_id": "T042765",
              "product_identification_helper": {
                "cpe": "cpe:/a:f5:big-ip:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "F5"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74185",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "FreeBSD Project FreeBSD OS",
            "product": {
              "name": "FreeBSD Project FreeBSD OS",
              "product_id": "4035",
              "product_identification_helper": {
                "cpe": "cpe:/o:freebsd:freebsd:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "FreeBSD Project"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.3",
                "product": {
                  "name": "IBM AIX 7.3",
                  "product_id": "1139691",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:ibm:aix:7.3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.2",
                "product": {
                  "name": "IBM AIX 7.2",
                  "product_id": "434967",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:ibm:aix:7.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "AIX"
          },
          {
            "category": "product_name",
            "name": "IBM App Connect Enterprise",
            "product": {
              "name": "IBM App Connect Enterprise",
              "product_id": "T032495",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:app_connect_enterprise:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.1.0.10",
                "product": {
                  "name": "IBM DevOps Code ClearCase \u003c9.1.0.10",
                  "product_id": "T048741"
                }
              },
              {
                "category": "product_version",
                "name": "9.1.0.10",
                "product": {
                  "name": "IBM DevOps Code ClearCase 9.1.0.10",
                  "product_id": "T048741-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:devops_code_clearcase:9.1.0.10"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.0.1.05",
                "product": {
                  "name": "IBM DevOps Code ClearCase \u003c10.0.1.05",
                  "product_id": "T048742"
                }
              },
              {
                "category": "product_version",
                "name": "10.0.1.05",
                "product": {
                  "name": "IBM DevOps Code ClearCase 10.0.1.05",
                  "product_id": "T048742-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:devops_code_clearcase:10.0.1.05"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c11.0.0.05",
                "product": {
                  "name": "IBM DevOps Code ClearCase \u003c11.0.0.05",
                  "product_id": "T048743"
                }
              },
              {
                "category": "product_version",
                "name": "11.0.0.05",
                "product": {
                  "name": "IBM DevOps Code ClearCase 11.0.0.05",
                  "product_id": "T048743-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:devops_code_clearcase:11.0.0.05"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "DevOps Code ClearCase"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Operator",
                "product": {
                  "name": "IBM MQ Operator",
                  "product_id": "T036688",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:operator"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Container",
                "product": {
                  "name": "IBM MQ Container",
                  "product_id": "T040640",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:container"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "MQ"
          },
          {
            "category": "product_name",
            "name": "IBM Power Hardware Management Console",
            "product": {
              "name": "IBM Power Hardware Management Console",
              "product_id": "5114",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:hardware_management_console:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "for multiplatforms",
                "product": {
                  "name": "IBM TXSeries for multiplatforms",
                  "product_id": "T036617",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:txseries:for_multiplatforms"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "TXSeries"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.1",
                "product": {
                  "name": "IBM VIOS 3.1",
                  "product_id": "1039165",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:vios:3.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "4.1",
                "product": {
                  "name": "IBM VIOS 4.1",
                  "product_id": "1522854",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:vios:4.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "VIOS"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c11.11.100",
                "product": {
                  "name": "IGEL OS \u003c11.11.100",
                  "product_id": "T043218"
                }
              },
              {
                "category": "product_version",
                "name": "11.11.100",
                "product": {
                  "name": "IGEL OS 11.11.100",
                  "product_id": "T043218-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:igel:os:11.11.100"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c12.7.4",
                "product": {
                  "name": "IGEL OS \u003c12.7.4",
                  "product_id": "T047577"
                }
              },
              {
                "category": "product_version",
                "name": "12.7.4",
                "product": {
                  "name": "IGEL OS 12.7.4",
                  "product_id": "T047577-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:igel:os:12.7.4"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OS"
          }
        ],
        "category": "vendor",
        "name": "IGEL"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.10.004",
                "product": {
                  "name": "Meinberg LANTIME \u003c7.10.004",
                  "product_id": "T048945"
                }
              },
              {
                "category": "product_version",
                "name": "7.10.004",
                "product": {
                  "name": "Meinberg LANTIME 7.10.004",
                  "product_id": "T048945-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:meinberg:lantime:7.10.004"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "LANTIME"
          }
        ],
        "category": "vendor",
        "name": "Meinberg"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c4.0.1",
                "product": {
                  "name": "Open Source LibreSSL \u003c4.0.1",
                  "product_id": "T047309"
                }
              },
              {
                "category": "product_version",
                "name": "4.0.1",
                "product": {
                  "name": "Open Source LibreSSL 4.0.1",
                  "product_id": "T047309-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openbsd:libressl:4.0.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c4.1.1",
                "product": {
                  "name": "Open Source LibreSSL \u003c4.1.1",
                  "product_id": "T047310"
                }
              },
              {
                "category": "product_version",
                "name": "4.1.1",
                "product": {
                  "name": "Open Source LibreSSL 4.1.1",
                  "product_id": "T047310-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openbsd:libressl:4.1.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "LibreSSL"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.5.4",
                "product": {
                  "name": "Open Source OpenSSL \u003c3.5.4",
                  "product_id": "T047302"
                }
              },
              {
                "category": "product_version",
                "name": "3.5.4",
                "product": {
                  "name": "Open Source OpenSSL 3.5.4",
                  "product_id": "T047302-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openssl:openssl:3.5.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c3.4.3",
                "product": {
                  "name": "Open Source OpenSSL \u003c3.4.3",
                  "product_id": "T047303"
                }
              },
              {
                "category": "product_version",
                "name": "3.4.3",
                "product": {
                  "name": "Open Source OpenSSL 3.4.3",
                  "product_id": "T047303-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openssl:openssl:3.4.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c3.3.5",
                "product": {
                  "name": "Open Source OpenSSL \u003c3.3.5",
                  "product_id": "T047304"
                }
              },
              {
                "category": "product_version",
                "name": "3.3.5",
                "product": {
                  "name": "Open Source OpenSSL 3.3.5",
                  "product_id": "T047304-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openssl:openssl:3.3.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c3.2.6",
                "product": {
                  "name": "Open Source OpenSSL \u003c3.2.6",
                  "product_id": "T047305"
                }
              },
              {
                "category": "product_version",
                "name": "3.2.6",
                "product": {
                  "name": "Open Source OpenSSL 3.2.6",
                  "product_id": "T047305-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openssl:openssl:3.2.6"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c3.0.18",
                "product": {
                  "name": "Open Source OpenSSL \u003c3.0.18",
                  "product_id": "T047306"
                }
              },
              {
                "category": "product_version",
                "name": "3.0.18",
                "product": {
                  "name": "Open Source OpenSSL 3.0.18",
                  "product_id": "T047306-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openssl:openssl:3.0.18"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c1.1.1zd",
                "product": {
                  "name": "Open Source OpenSSL \u003c1.1.1zd",
                  "product_id": "T047307"
                }
              },
              {
                "category": "product_version",
                "name": "1.1.1zd",
                "product": {
                  "name": "Open Source OpenSSL 1.1.1zd",
                  "product_id": "T047307-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openssl:openssl:1.1.1zd"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c1.0.2zm",
                "product": {
                  "name": "Open Source OpenSSL \u003c1.0.2zm",
                  "product_id": "T047308"
                }
              },
              {
                "category": "product_version",
                "name": "1.0.2zm",
                "product": {
                  "name": "Open Source OpenSSL 1.0.2zm",
                  "product_id": "T047308-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openssl:openssl:1.0.2zm"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenSSL"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "RESF Rocky Linux",
            "product": {
              "name": "RESF Rocky Linux",
              "product_id": "T032255",
              "product_identification_helper": {
                "cpe": "cpe:/o:resf:rocky_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "RESF"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Container Platform \u003c4.14.62",
                "product": {
                  "name": "Red Hat OpenShift Container Platform \u003c4.14.62",
                  "product_id": "T051279"
                }
              },
              {
                "category": "product_version",
                "name": "Container Platform 4.14.62",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.14.62",
                  "product_id": "T051279-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform__4.14.62"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenShift"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "SUSE openSUSE",
            "product": {
              "name": "SUSE openSUSE",
              "product_id": "T027843",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:opensuse:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2026.1",
                "product": {
                  "name": "SolarWinds Platform \u003c2026.1",
                  "product_id": "T050624"
                }
              },
              {
                "category": "product_version",
                "name": "2026.1",
                "product": {
                  "name": "SolarWinds Platform 2026.1",
                  "product_id": "T050624-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:solarwinds:orion_platform:2026.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Platform"
          }
        ],
        "category": "vendor",
        "name": "SolarWinds"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.2.0",
                "product": {
                  "name": "Splunk Splunk Enterprise \u003c10.2.0",
                  "product_id": "T050416"
                }
              },
              {
                "category": "product_version",
                "name": "10.2.0",
                "product": {
                  "name": "Splunk Splunk Enterprise 10.2.0",
                  "product_id": "T050416-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:splunk:splunk:10.2.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.0.3",
                "product": {
                  "name": "Splunk Splunk Enterprise \u003c10.0.3",
                  "product_id": "T050417"
                }
              },
              {
                "category": "product_version",
                "name": "10.0.3",
                "product": {
                  "name": "Splunk Splunk Enterprise 10.0.3",
                  "product_id": "T050417-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:splunk:splunk:10.0.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.3.9",
                "product": {
                  "name": "Splunk Splunk Enterprise \u003c9.3.9",
                  "product_id": "T050419"
                }
              },
              {
                "category": "product_version",
                "name": "9.3.9",
                "product": {
                  "name": "Splunk Splunk Enterprise 9.3.9",
                  "product_id": "T050419-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:splunk:splunk:9.3.9"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.2.12",
                "product": {
                  "name": "Splunk Splunk Enterprise \u003c9.2.12",
                  "product_id": "T050420"
                }
              },
              {
                "category": "product_version",
                "name": "9.2.12",
                "product": {
                  "name": "Splunk Splunk Enterprise 9.2.12",
                  "product_id": "T050420-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:splunk:splunk:9.2.12"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Universal Forwarder",
                "product": {
                  "name": "Splunk Splunk Enterprise Universal Forwarder",
                  "product_id": "T050995",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:splunk:splunk:universal_forwarder"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.4.8",
                "product": {
                  "name": "Splunk Splunk Enterprise \u003c9.4.8",
                  "product_id": "T050996"
                }
              },
              {
                "category": "product_version",
                "name": "9.4.8",
                "product": {
                  "name": "Splunk Splunk Enterprise 9.4.8",
                  "product_id": "T050996-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:splunk:splunk:9.4.8"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Splunk Enterprise"
          }
        ],
        "category": "vendor",
        "name": "Splunk"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.0 SP-3 (93.M3.14.86)",
                "product": {
                  "name": "Xerox FreeFlow Print Server \u003c9.0 SP-3 (93.M3.14.86)",
                  "product_id": "T051478"
                }
              },
              {
                "category": "product_version",
                "name": "9.0 SP-3 (93.M3.14.86)",
                "product": {
                  "name": "Xerox FreeFlow Print Server 9.0 SP-3 (93.M3.14.86)",
                  "product_id": "T051478-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:xerox:freeflow_print_server:9.0_sp-3_%2893.m3.14.86%29"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FreeFlow Print Server"
          }
        ],
        "category": "vendor",
        "name": "Xerox"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-9230",
      "product_status": {
        "known_affected": [
          "67646",
          "4035",
          "T050996",
          "T036688",
          "T050995",
          "T004914",
          "1139691",
          "T047306",
          "T047307",
          "T047304",
          "T047305",
          "T050624",
          "T047308",
          "T047309",
          "398363",
          "T047302",
          "T047303",
          "T036617",
          "434967",
          "5114",
          "1039165",
          "T051478",
          "1522854",
          "T051279",
          "T032255",
          "74185",
          "T050420",
          "T032495",
          "T050419",
          "T048945",
          "2951",
          "T002207",
          "T042765",
          "T000126",
          "T043218",
          "T050417",
          "T050416",
          "T027843",
          "T047310",
          "T047577",
          "T040640",
          "T048743",
          "T048742",
          "T048301",
          "T048741"
        ]
      },
      "release_date": "2025-09-30T22:00:00.000+00:00",
      "title": "CVE-2025-9230"
    },
    {
      "cve": "CVE-2025-9231",
      "product_status": {
        "known_affected": [
          "67646",
          "4035",
          "T050996",
          "T036688",
          "T050995",
          "T004914",
          "1139691",
          "T047304",
          "T047305",
          "T050624",
          "398363",
          "T047302",
          "T047303",
          "T036617",
          "434967",
          "5114",
          "1039165",
          "T051478",
          "1522854",
          "T051279",
          "T032255",
          "74185",
          "T050420",
          "T032495",
          "T050419",
          "T048945",
          "2951",
          "T002207",
          "T042765",
          "T000126",
          "T043218",
          "T050417",
          "T050416",
          "T027843",
          "T047577",
          "T040640",
          "T048743",
          "T048742",
          "T048301",
          "T048741"
        ]
      },
      "release_date": "2025-09-30T22:00:00.000+00:00",
      "title": "CVE-2025-9231"
    },
    {
      "cve": "CVE-2025-9232",
      "product_status": {
        "known_affected": [
          "67646",
          "4035",
          "T050996",
          "T036688",
          "T050995",
          "T004914",
          "1139691",
          "T047306",
          "T047304",
          "T047305",
          "T050624",
          "398363",
          "T047302",
          "T047303",
          "T036617",
          "434967",
          "5114",
          "1039165",
          "T051478",
          "1522854",
          "T051279",
          "T032255",
          "74185",
          "T050420",
          "T032495",
          "T050419",
          "T048945",
          "2951",
          "T002207",
          "T042765",
          "T000126",
          "T043218",
          "T050417",
          "T050416",
          "T027843",
          "T047577",
          "T040640",
          "T048743",
          "T048742",
          "T048301",
          "T048741"
        ]
      },
      "release_date": "2025-09-30T22:00:00.000+00:00",
      "title": "CVE-2025-9232"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Oracle Financial Services ist eine Zusammenstellung  von Anwendungen f\u00fcr den Finanzsektor und eine Technologiebasis zur Erf\u00fcllung von IT- und Gesch\u00e4ftsanforderungen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0163 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0163.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0163 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0163"
      },
      {
        "category": "external",
        "summary": "Oracle Critical Patch Update Advisory - January 2026 - Appendix Oracle Financial Services Applications vom 2026-01-20",
        "url": "https://www.oracle.com/security-alerts/cpujan2026.html#AppendixIFLX"
      }
    ],
    "source_lang": "en-US",
    "title": "Oracle Financial Services Applications: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-01-20T23:00:00.000+00:00",
      "generator": {
        "date": "2026-01-21T08:54:09.582+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0163",
      "initial_release_date": "2026-01-20T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-01-20T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "14.7.0.0.0",
                "product": {
                  "name": "Oracle Financial Services Applications 14.7.0.0.0",
                  "product_id": "T028702",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:financial_services_applications:14.7.0.0.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "14.5.0.0.0",
                "product": {
                  "name": "Oracle Financial Services Applications 14.5.0.0.0",
                  "product_id": "T034160",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:financial_services_applications:14.5.0.0.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "14.6.0.0.0",
                "product": {
                  "name": "Oracle Financial Services Applications 14.6.0.0.0",
                  "product_id": "T034161",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:financial_services_applications:14.6.0.0.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=14.8.0.0.0",
                "product": {
                  "name": "Oracle Financial Services Applications \u003c=14.8.0.0.0",
                  "product_id": "T047909"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=14.8.0.0.0",
                "product": {
                  "name": "Oracle Financial Services Applications \u003c=14.8.0.0.0",
                  "product_id": "T047909-fixed"
                }
              },
              {
                "category": "product_version",
                "name": "8.1.3.2",
                "product": {
                  "name": "Oracle Financial Services Applications 8.1.3.2",
                  "product_id": "T047911",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:financial_services_applications:8.1.3.2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "14.8.1.0.0",
                "product": {
                  "name": "Oracle Financial Services Applications 14.8.1.0.0",
                  "product_id": "T050133",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:financial_services_applications:14.8.1.0.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "14.5.0.15.0",
                "product": {
                  "name": "Oracle Financial Services Applications 14.5.0.15.0",
                  "product_id": "T050134",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:financial_services_applications:14.5.0.15.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "14.6.0.11.0",
                "product": {
                  "name": "Oracle Financial Services Applications 14.6.0.11.0",
                  "product_id": "T050135",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:financial_services_applications:14.6.0.11.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "14.7.0.9.0",
                "product": {
                  "name": "Oracle Financial Services Applications 14.7.0.9.0",
                  "product_id": "T050136",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:financial_services_applications:14.7.0.9.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "14.8.0.1.0",
                "product": {
                  "name": "Oracle Financial Services Applications 14.8.0.1.0",
                  "product_id": "T050137",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:financial_services_applications:14.8.0.1.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "14.7.0.8.0",
                "product": {
                  "name": "Oracle Financial Services Applications 14.7.0.8.0",
                  "product_id": "T050138",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:financial_services_applications:14.7.0.8.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "2.6.0",
                "product": {
                  "name": "Oracle Financial Services Applications 2.6.0",
                  "product_id": "T050139",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:financial_services_applications:2.6.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "14.5.0.14.0",
                "product": {
                  "name": "Oracle Financial Services Applications 14.5.0.14.0",
                  "product_id": "T050140",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:financial_services_applications:14.5.0.14.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=12.0.6",
                "product": {
                  "name": "Oracle Financial Services Applications \u003c=12.0.6",
                  "product_id": "T050141"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=12.0.6",
                "product": {
                  "name": "Oracle Financial Services Applications \u003c=12.0.6",
                  "product_id": "T050141-fixed"
                }
              }
            ],
            "category": "product_name",
            "name": "Financial Services Applications"
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-22228",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-22228"
    },
    {
      "cve": "CVE-2025-27817",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-27817"
    },
    {
      "cve": "CVE-2025-41248",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-41248"
    },
    {
      "cve": "CVE-2025-41249",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-41249"
    },
    {
      "cve": "CVE-2025-48734",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-48734"
    },
    {
      "cve": "CVE-2025-48795",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-48795"
    },
    {
      "cve": "CVE-2025-48924",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-48924"
    },
    {
      "cve": "CVE-2025-48976",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-48976"
    },
    {
      "cve": "CVE-2025-49796",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-49796"
    },
    {
      "cve": "CVE-2025-5115",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-5115"
    },
    {
      "cve": "CVE-2025-55163",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-55163"
    },
    {
      "cve": "CVE-2025-61795",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-61795"
    },
    {
      "cve": "CVE-2025-66418",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-66418"
    },
    {
      "cve": "CVE-2025-9230",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-9230"
    },
    {
      "cve": "CVE-2026-21973",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2026-21973"
    },
    {
      "cve": "CVE-2026-21978",
      "product_status": {
        "known_affected": [
          "T047911",
          "T050140",
          "T034161",
          "T034160",
          "T050139",
          "T050136",
          "T028702",
          "T050135",
          "T050138",
          "T050137",
          "T050134",
          "T050133"
        ],
        "last_affected": [
          "T050141",
          "T047909"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2026-21978"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Oracle PeopleSoft ist eine ERP Anwendung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle PeopleSoft ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0167 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0167.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0167 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0167"
      },
      {
        "category": "external",
        "summary": "Oracle Critical Patch Update Advisory - January 2026 - Appendix Oracle PeopleSoft vom 2026-01-20",
        "url": "https://www.oracle.com/security-alerts/cpujan2026.html#AppendixPS"
      }
    ],
    "source_lang": "en-US",
    "title": "Oracle PeopleSoft: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-01-20T23:00:00.000+00:00",
      "generator": {
        "date": "2026-01-21T09:05:45.182+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0167",
      "initial_release_date": "2026-01-20T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-01-20T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "9.2",
                "product": {
                  "name": "Oracle PeopleSoft 9.2",
                  "product_id": "T019030",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:peoplesoft:9.2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.6",
                "product": {
                  "name": "Oracle PeopleSoft 8.60",
                  "product_id": "T025008",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:peoplesoft:8.60"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.61",
                "product": {
                  "name": "Oracle PeopleSoft 8.61",
                  "product_id": "T032124",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:peoplesoft:8.61"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.62",
                "product": {
                  "name": "Oracle PeopleSoft 8.62",
                  "product_id": "T042827",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:peoplesoft:8.62"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft"
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-27210",
      "product_status": {
        "known_affected": [
          "T032124",
          "T025008",
          "T019030",
          "T042827"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-27210"
    },
    {
      "cve": "CVE-2025-48924",
      "product_status": {
        "known_affected": [
          "T032124",
          "T025008",
          "T019030",
          "T042827"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-48924"
    },
    {
      "cve": "CVE-2025-55163",
      "product_status": {
        "known_affected": [
          "T032124",
          "T025008",
          "T019030",
          "T042827"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-55163"
    },
    {
      "cve": "CVE-2025-66516",
      "product_status": {
        "known_affected": [
          "T032124",
          "T025008",
          "T019030",
          "T042827"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-66516"
    },
    {
      "cve": "CVE-2025-6965",
      "product_status": {
        "known_affected": [
          "T032124",
          "T025008",
          "T019030",
          "T042827"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-6965"
    },
    {
      "cve": "CVE-2025-9086",
      "product_status": {
        "known_affected": [
          "T032124",
          "T025008",
          "T019030",
          "T042827"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-9086"
    },
    {
      "cve": "CVE-2025-9230",
      "product_status": {
        "known_affected": [
          "T032124",
          "T025008",
          "T019030",
          "T042827"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-9230"
    },
    {
      "cve": "CVE-2026-21934",
      "product_status": {
        "known_affected": [
          "T032124",
          "T025008",
          "T019030",
          "T042827"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2026-21934"
    },
    {
      "cve": "CVE-2026-21938",
      "product_status": {
        "known_affected": [
          "T032124",
          "T025008",
          "T019030",
          "T042827"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2026-21938"
    },
    {
      "cve": "CVE-2026-21951",
      "product_status": {
        "known_affected": [
          "T032124",
          "T025008",
          "T019030",
          "T042827"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2026-21951"
    },
    {
      "cve": "CVE-2026-21961",
      "product_status": {
        "known_affected": [
          "T032124",
          "T025008",
          "T019030",
          "T042827"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2026-21961"
    },
    {
      "cve": "CVE-2026-21971",
      "product_status": {
        "known_affected": [
          "T032124",
          "T025008",
          "T019030",
          "T042827"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2026-21971"
    }
  ]
}