Action not permitted
Modal body text goes here.
cve-2014-0112
Vulnerability from cvelistv5
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T09:05:38.849Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://cwiki.apache.org/confluence/display/WW/S2-021" }, { "name": "59178", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/59178" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.vmware.com/security/advisories/VMSA-2014-0007.html" }, { "name": "20140426 [ANN] Struts 2.3.16.2 GA release available - security fix", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "url": "http://www.securityfocus.com/archive/1/531952/100/0/threaded" }, { "name": "59500", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/59500" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html" }, { "name": "67064", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/67064" }, { "name": "JVN#19294237", "tags": [ "third-party-advisory", "x_refsource_JVN", "x_transferred" ], "url": "http://jvn.jp/en/jp/JVN19294237/index.html" }, { "name": "JVNDB-2014-000045", "tags": [ "third-party-advisory", "x_refsource_JVNDB", "x_transferred" ], "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676706" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1091939" }, { "name": "20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "url": "http://www.securityfocus.com/archive/1/532549/100/0/threaded" }, { "name": "RHSA-2019:0910", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:0910" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2014-04-25T00:00:00", "descriptions": [ { "lang": "en", "value": "ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2019-08-12T20:45:52", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://cwiki.apache.org/confluence/display/WW/S2-021" }, { "name": "59178", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/59178" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.vmware.com/security/advisories/VMSA-2014-0007.html" }, { "name": "20140426 [ANN] Struts 2.3.16.2 GA release available - security fix", "tags": [ "mailing-list", "x_refsource_BUGTRAQ" ], "url": "http://www.securityfocus.com/archive/1/531952/100/0/threaded" }, { "name": "59500", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/59500" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html" }, { "name": "67064", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/67064" }, { "name": "JVN#19294237", "tags": [ "third-party-advisory", "x_refsource_JVN" ], "url": "http://jvn.jp/en/jp/JVN19294237/index.html" }, { "name": "JVNDB-2014-000045", "tags": [ "third-party-advisory", "x_refsource_JVNDB" ], "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676706" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1091939" }, { "name": "20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library", "tags": [ "mailing-list", "x_refsource_BUGTRAQ" ], "url": "http://www.securityfocus.com/archive/1/532549/100/0/threaded" }, { "name": "RHSA-2019:0910", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:0910" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2014-0112", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html" }, { "name": "https://cwiki.apache.org/confluence/display/WW/S2-021", "refsource": "CONFIRM", "url": "https://cwiki.apache.org/confluence/display/WW/S2-021" }, { "name": "59178", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/59178" }, { "name": "http://www.vmware.com/security/advisories/VMSA-2014-0007.html", "refsource": "CONFIRM", "url": "http://www.vmware.com/security/advisories/VMSA-2014-0007.html" }, { "name": "20140426 [ANN] Struts 2.3.16.2 GA release available - security fix", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/531952/100/0/threaded" }, { "name": "59500", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/59500" }, { "name": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html" }, { "name": "67064", "refsource": "BID", "url": "http://www.securityfocus.com/bid/67064" }, { "name": "JVN#19294237", "refsource": "JVN", "url": "http://jvn.jp/en/jp/JVN19294237/index.html" }, { "name": "JVNDB-2014-000045", "refsource": "JVNDB", "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045" }, { "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676706", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676706" }, { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1091939", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1091939" }, { "name": "20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/532549/100/0/threaded" }, { "name": "RHSA-2019:0910", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:0910" } ] } } } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2014-0112", "datePublished": "2014-04-29T10:00:00", "dateReserved": "2013-12-03T00:00:00", "dateUpdated": "2024-08-06T09:05:38.849Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2014-0112\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2014-04-29T10:37:03.670\",\"lastModified\":\"2019-08-12T21:15:12.360\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to \\\"manipulate\\\" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.\"},{\"lang\":\"es\",\"value\":\"ParametersInterceptor en Apache Struts versiones anteriores a 2.3.20, no restringe apropiadamente el acceso al m\u00e9todo getClass, lo que permite a atacantes remotos \\\"manipulate\\\" el ClassLoader y ejecutar c\u00f3digo arbitrario por medio de una petici\u00f3n dise\u00f1ada. NOTA: esta vulnerabilidad se presenta debido a una correcci\u00f3n incompleta de CVE-2014-0094.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":7.5},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndExcluding\":\"2.3.16.2\",\"matchCriteriaId\":\"769DE043-2954-4F02-A260-91484452AC83\"}]}]}],\"references\":[{\"url\":\"http://jvn.jp/en/jp/JVN19294237/index.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://secunia.com/advisories/59178\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Permissions Required\"]},{\"url\":\"http://secunia.com/advisories/59500\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Permissions Required\"]},{\"url\":\"http://www-01.ibm.com/support/docview.wss?uid=swg21676706\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/archive/1/531952/100/0/threaded\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/archive/1/532549/100/0/threaded\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/bid/67064\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.vmware.com/security/advisories/VMSA-2014-0007.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:0910\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1091939\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://cwiki.apache.org/confluence/display/WW/S2-021\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}" } }
cve-2014-0112
Vulnerability from jvndb
{ "@rdf:about": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000045.html", "dc:date": "2015-05-08T18:01+09:00", "dcterms:issued": "2014-04-25T15:37+09:00", "dcterms:modified": "2015-05-08T18:01+09:00", "description": "Apache Struts provided by the Apache Software Foundation is a software framework for creating Java web applications. Apache Struts contains a vulnerability where the ClassLoader may be manipulated.\r\n\r\nNTT-CERT reported this vulnerability to IPA.\r\n JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.", "link": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000045.html", "sec:cpe": [ { "#text": "cpe:/a:apache:struts", "@product": "Apache Struts", "@vendor": "Apache Software Foundation", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:cloud_infrastructure_management_software", "@product": "Cloud Infrastructure Management Software", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:integrated_system_ha_database_ready", "@product": "FUJITSU Integrated System HA Database Ready", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:interstage", "@product": "Interstage", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:interstage_application_development_cycle_manager", "@product": "Interstage Application Development Cycle Manager", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:interstage_application_framework_suite", "@product": "Interstage Application Framework Suite", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:interstage_application_server", "@product": "Interstage Application Server", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:interstage_apworks", "@product": "Interstage Apworks", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:interstage_business_application_server", "@product": "Interstage Business Application Server", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:interstage_interaction_manager", "@product": "Interstage Interaction Manager", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:interstage_job_workload_server", "@product": "Interstage Job Workload Server", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:interstage_service_integrator", "@product": "Interstage Service Integrator", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:interstage_studio", "@product": "Interstage Studio", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:serverview", "@product": "ServerView", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:symfoware", "@product": "Symfoware", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:systemwalker_service_catalog_manager", "@product": "Systemwalker Service Catalog Manager", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:systemwalker_service_quality_coordinator", "@product": "Systemwalker Service Quality Coordinator", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:systemwalker_software_configuration_manager", "@product": "Systemwalker Software Configuration Manager", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/a:fujitsu:triole", "@product": "TRIOLE", "@vendor": "FUJITSU", "@version": "2.2" }, { "#text": "cpe:/o:misc:miraclelinux_asianux_server", "@product": "Asianux Server", "@vendor": "Cybertrust Japan Co., Ltd.", "@version": "2.2" } ], "sec:cvss": { "@score": "7.5", "@severity": "High", "@type": "Base", "@vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "@version": "2.0" }, "sec:identifier": "JVNDB-2014-000045", "sec:references": [ { "#text": "http://jvn.jp/en/jp/JVN19294237/index.html", "@id": "JVN#19294237", "@source": "JVN" }, { "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0094", "@id": "CVE-2014-0094", "@source": "CVE" }, { "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0112", "@id": "CVE-2014-0112", "@source": "CVE" }, { "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0094", "@id": "CVE-2014-0094", "@source": "NVD" }, { "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0112", "@id": "CVE-2014-0112", "@source": "NVD" }, { "#text": "http://www.ipa.go.jp/security/ciadr/vul/20140417-struts.html", "@id": "[Updated] Security Alert for Vulnerability in the \"Apache Struts2\" (CVE-2014-0094)(S2-020)", "@source": "IPA SECURITY ALERTS" }, { "#text": "http://www.kb.cert.org/vuls/id/719225", "@id": "VU#719225", "@source": "CERT-VN" }, { "#text": "http://www.konakart.com/downloads/ver-7-3-0-0-whats-new/", "@id": "Ver 7.3.0.0 - What\u2019s New?", "@source": "Related document" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-DesignError", "@title": "No Mapping(CWE-DesignError)" } ], "title": "Apache Struts vulnerable to ClassLoader manipulation" }
wid-sec-w-2023-2068
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "MySQL ist ein Open Source Datenbankserver von Oracle.\r\nDer MySQL Enterprise Monitor \u00fcberwacht kontinuierlich MySQL Anfragen und performaz relevante Server Werte.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um dadurch die Integrit\u00e4t, Vertraulichkeit und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-2068 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2015/wid-sec-w-2023-2068.json" }, { "category": "self", "summary": "WID-SEC-2023-2068 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2068" }, { "category": "external", "summary": "F5 Security Advisory K17115 vom 2023-08-16", "url": "https://my.f5.com/manage/s/article/K17115" }, { "category": "external", "summary": "Debian Security Advisory DSA-3229-1 vom 2015-04-19", "url": "https://www.debian.org/security/2015/dsa-3229" }, { "category": "external", "summary": "Ubuntu Security Notice USN-2575-1 vom 2015-04-21", "url": "http://www.ubuntu.com/usn/usn-2575-1/" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory Appendix MSQL vom 2015-04-14", "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html#AppendixMSQL" }, { "category": "external", "summary": "Ubuntu MariaDB 10.0.18 Release NotesNotice USN-2575-1 vom 2015-04-21 vom 2015-05-21", "url": "https://mariadb.com/kb/en/mariadb/mariadb-10018-release-notes/" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2015:0946-1 vom 2015-05-26", "url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150946-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2015:0946-1 vom 2015-05-26", "url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150946-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2015:0946-1 vom 2015-05-26", "url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150946-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2015:0946-1 vom 2015-05-26", "url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150946-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2015:0946-1 vom 2015-05-26", "url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150946-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2015:0946-1 vom 2015-05-26", "url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150946-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2015:0946-1 vom 2015-05-26", "url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150946-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2015:0946-1 vom 2015-05-26", "url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150946-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2015:1273-1 vom 2015-07-21", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00036.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-3311 vom 2015-07-20", "url": "https://www.debian.org/security/2015/dsa-3311" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2015:1629-1 vom 2015-08-17", "url": "http://rhn.redhat.com/errata/RHSA-2015-1629.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2015:1628-1 vom 2015-08-17", "url": "http://rhn.redhat.com/errata/RHSA-2015-1628.html" }, { "category": "external", "summary": "CESA-2015:1628 Moderate CentOS 5 mysql55-mysql Security Update vom 2015-08-17", "url": "http://lists.centos.org/pipermail/centos-announce/2015-August/021331.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2015:1647 vom 2015-08-20", "url": "https://rhn.redhat.com/errata/RHSA-2015-1647.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2015:1665-1 vom 2015-08-24", "url": "https://rhn.redhat.com/errata/RHSA-2015-1665.html" }, { "category": "external", "summary": "CentOS Errata and Security Advisory 2015:1665 vom 2015-08-25", "url": "http://lists.centos.org/pipermail/centos-announce/2015-August/021345.html" }, { "category": "external", "summary": "Juniper Security Advisory JSA10698", "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10698" }, { "category": "external", "summary": "F5 Security Advisory SOL17115 vom 2015-10-19", "url": "https://support.f5.com/kb/en-us/solutions/public/17000/100/sol17115.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-3621 vom 2016-07-19", "url": "https://www.debian.org/security/2016/dsa-3621" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2016:2259-1 vom 2016-09-08", "url": "https://www.suse.com/support/update/announcement/2016/suse-su-20162259-1.html" } ], "source_lang": "en-US", "title": "Oracle MySQL: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-08-15T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:40:36.570+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-2068", "initial_release_date": "2015-04-14T22:00:00.000+00:00", "revision_history": [ { "date": "2015-04-14T22:00:00.000+00:00", "number": "1", "summary": "Initial Release" }, { "date": "2015-04-14T22:00:00.000+00:00", "number": "2", "summary": "Version nicht vorhanden" }, { "date": "2015-04-19T22:00:00.000+00:00", "number": "3", "summary": "New remediations available" }, { "date": "2015-04-21T22:00:00.000+00:00", "number": "4", "summary": "New remediations available" }, { "date": "2015-04-21T22:00:00.000+00:00", "number": "5", "summary": "Version nicht vorhanden" }, { "date": "2015-05-26T22:00:00.000+00:00", "number": "6", "summary": "New remediations available" }, { "date": "2015-05-26T22:00:00.000+00:00", "number": "7", "summary": "Version nicht vorhanden" }, { "date": "2015-07-19T22:00:00.000+00:00", "number": "8", "summary": "New remediations available" }, { "date": "2015-07-19T22:00:00.000+00:00", "number": "9", "summary": "Version nicht vorhanden" }, { "date": "2015-07-21T22:00:00.000+00:00", "number": "10", "summary": "New remediations available" }, { "date": "2015-08-17T22:00:00.000+00:00", "number": "11", "summary": "New remediations available" }, { "date": "2015-08-17T22:00:00.000+00:00", "number": "12", "summary": "Version nicht vorhanden" }, { "date": "2015-08-18T22:00:00.000+00:00", "number": "13", "summary": "New remediations available" }, { "date": "2015-08-18T22:00:00.000+00:00", "number": "14", "summary": "Version nicht vorhanden" }, { "date": "2015-08-18T22:00:00.000+00:00", "number": "15", "summary": "Version nicht vorhanden" }, { "date": "2015-08-24T22:00:00.000+00:00", "number": "16", "summary": "New remediations available" }, { "date": "2015-08-24T22:00:00.000+00:00", "number": "17", "summary": "Version nicht vorhanden" }, { "date": "2015-08-25T22:00:00.000+00:00", "number": "18", "summary": "New remediations available" }, { "date": "2015-08-25T22:00:00.000+00:00", "number": "19", "summary": "Version nicht vorhanden" }, { "date": "2015-10-14T22:00:00.000+00:00", "number": "20", "summary": "New remediations available" }, { "date": "2015-10-14T22:00:00.000+00:00", "number": "21", "summary": "Version nicht vorhanden" }, { "date": "2015-10-19T22:00:00.000+00:00", "number": "22", "summary": "New remediations available" }, { "date": "2015-10-19T22:00:00.000+00:00", "number": "23", "summary": "Version nicht vorhanden" }, { "date": "2016-07-18T22:00:00.000+00:00", "number": "24", "summary": "New remediations available" }, { "date": "2016-09-07T22:00:00.000+00:00", "number": "25", "summary": "New remediations available" }, { "date": "2023-08-15T22:00:00.000+00:00", "number": "26", "summary": "Neue Updates von F5 aufgenommen" } ], "status": "final", "version": "26" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "category": "product_name", "name": "F5 BIG-IP \u003c 14.0.0", "product": { "name": "F5 BIG-IP \u003c 14.0.0", "product_id": "T023087", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip:14.0.0" } } } ], "category": "vendor", "name": "F5" }, { "branches": [ { "category": "product_name", "name": "Juniper Junos Space", "product": { "name": "Juniper Junos Space", "product_id": "T003343", "product_identification_helper": { "cpe": "cpe:/a:juniper:junos_space:-" } } } ], "category": "vendor", "name": "Juniper" }, { "branches": [ { "category": "product_name", "name": "MariaDB MariaDB \u003c 10.0.18", "product": { "name": "MariaDB MariaDB \u003c 10.0.18", "product_id": "T005086", "product_identification_helper": { "cpe": "cpe:/a:mariadb:mariadb:10.0.18" } } } ], "category": "vendor", "name": "MariaDB" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Open Source CentOS 5", "product": { "name": "Open Source CentOS 5", "product_id": "122559", "product_identification_helper": { "cpe": "cpe:/o:centos:centos:5" } } }, { "category": "product_name", "name": "Open Source CentOS 7", "product": { "name": "Open Source CentOS 7", "product_id": "T003633", "product_identification_helper": { "cpe": "cpe:/o:centos:centos:7" } } } ], "category": "product_name", "name": "CentOS" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle MySQL \u003c= 5.6.23", "product": { "name": "Oracle MySQL \u003c= 5.6.23", "product_id": "T004467", "product_identification_helper": { "cpe": "cpe:/a:oracle:mysql:5.6.23" } } }, { "category": "product_name", "name": "Oracle MySQL \u003c= 5.1.34", "product": { "name": "Oracle MySQL \u003c= 5.1.34", "product_id": "T004850", "product_identification_helper": { "cpe": "cpe:/a:oracle:mysql:5.1.34" } } }, { "category": "product_name", "name": "Oracle MySQL \u003c= 5.5.41", "product": { "name": "Oracle MySQL \u003c= 5.5.41", "product_id": "T004851", "product_identification_helper": { "cpe": "cpe:/a:oracle:mysql:5.5.41" } } }, { "category": "product_name", "name": "Oracle MySQL \u003c= 5.5.42", "product": { "name": "Oracle MySQL \u003c= 5.5.42", "product_id": "T004852", "product_identification_helper": { "cpe": "cpe:/a:oracle:mysql:5.5.42" } } }, { "category": "product_name", "name": "Oracle MySQL \u003c= 5.6.22", "product": { "name": "Oracle MySQL \u003c= 5.6.22", "product_id": "T004857", "product_identification_helper": { "cpe": "cpe:/a:oracle:mysql:5.6.22" } } } ], "category": "product_name", "name": "MySQL" } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 6", "product": { "name": "Red Hat Enterprise Linux 6", "product_id": "120737", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux 5", "product": { "name": "Red Hat Enterprise Linux 5", "product_id": "T000179", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:5" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux 7", "product": { "name": "Red Hat Enterprise Linux 7", "product_id": "T003303", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server 7", "product": { "name": "Red Hat Enterprise Linux Server 7", "product_id": "T003550", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } } ], "category": "product_name", "name": "Enterprise Linux" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "F5 BIG-IP Access Policy Manager 10.1.0 - 10.2.4", "product": { "name": "F5 BIG-IP Access Policy Manager 10.1.0 - 10.2.4", "product_id": "199182", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_access_policy_manager:10.2.4" } } }, { "category": "product_name", "name": "F5 BIG-IP Access Policy Manager 11.0.0 - 11.6.0", "product": { "name": "F5 BIG-IP Access Policy Manager 11.0.0 - 11.6.0", "product_id": "307369", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_access_policy_manager:11.6.0" } } }, { "category": "product_name", "name": "F5 BIG-IP Access Policy Manager 12.0.0", "product": { "name": "F5 BIG-IP Access Policy Manager 12.0.0", "product_id": "T005931", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_access_policy_manager:12.0.0" } } } ], "category": "product_name", "name": "big-ip_access_policy_manager" }, { "branches": [ { "category": "product_name", "name": "F5 BIG-IP Analytics 11.0.0 - 11.6.0", "product": { "name": "F5 BIG-IP Analytics 11.0.0 - 11.6.0", "product_id": "T003683", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_analytics:11.6.0" } } }, { "category": "product_name", "name": "F5 BIG-IP Analytics 12.0.0", "product": { "name": "F5 BIG-IP Analytics 12.0.0", "product_id": "T005928", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_analytics:12.0.0" } } } ], "category": "product_name", "name": "big-ip_analytics" }, { "branches": [ { "category": "product_name", "name": "F5 BIG-IP Application Security Manager 10.1.0 - 10.2.4", "product": { "name": "F5 BIG-IP Application Security Manager 10.1.0 - 10.2.4", "product_id": "T000548", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_application_security_manager:10.2.4" } } }, { "category": "product_name", "name": "F5 BIG-IP Application Security Manager 11.0.0 - 11.6.0", "product": { "name": "F5 BIG-IP Application Security Manager 11.0.0 - 11.6.0", "product_id": "T003684", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_application_security_manager:11.6.0" } } }, { "category": "product_name", "name": "F5 BIG-IP Application Security Manager 12.0.0", "product": { "name": "F5 BIG-IP Application Security Manager 12.0.0", "product_id": "T005932", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_application_security_manager:12.0.0" } } } ], "category": "product_name", "name": "big-ip_application_security_manager" }, { "branches": [ { "category": "product_name", "name": "F5 BIG-IP Edge Gateway 10.1.0 - 10.2.4", "product": { "name": "F5 BIG-IP Edge Gateway 10.1.0 - 10.2.4", "product_id": "241405", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_edge_gateway:10.2.4" } } }, { "category": "product_name", "name": "F5 BIG-IP Edge Gateway 11.0.0 - 11.3.0", "product": { "name": "F5 BIG-IP Edge Gateway 11.0.0 - 11.3.0", "product_id": "269856", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_edge_gateway:11.3.0" } } } ], "category": "product_name", "name": "big-ip_edge_gateway" }, { "branches": [ { "category": "product_name", "name": "F5 BIG-IP Global Traffic Manager 10.1.0 - 10.2.4", "product": { "name": "F5 BIG-IP Global Traffic Manager 10.1.0 - 10.2.4", "product_id": "T000523", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_global_traffic_manager:10.2.4" } } }, { "category": "product_name", "name": "F5 BIG-IP Global Traffic Manager 11.0.0 - 11.6.0", "product": { "name": "F5 BIG-IP Global Traffic Manager 11.0.0 - 11.6.0", "product_id": "T003686", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_global_traffic_manager:11.6.0" } } } ], "category": "product_name", "name": "big-ip_global_traffic_manager" }, { "branches": [ { "category": "product_name", "name": "F5 BIG-IP Link Controller 10.1.0 - 10.2.4", "product": { "name": "F5 BIG-IP Link Controller 10.1.0 - 10.2.4", "product_id": "T000541", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_link_controller:10.2.4" } } }, { "category": "product_name", "name": "F5 BIG-IP Link Controller 11.0.0 - 11.6.0", "product": { "name": "F5 BIG-IP Link Controller 11.0.0 - 11.6.0", "product_id": "T003687", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_link_controller:11.6.0" } } }, { "category": "product_name", "name": "F5 BIG-IP Link Controller 12.0.0", "product": { "name": "F5 BIG-IP Link Controller 12.0.0", "product_id": "T005938", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_link_controller:12.0.0" } } } ], "category": "product_name", "name": "big-ip_link_controller" }, { "branches": [ { "category": "product_name", "name": "F5 BIG-IP Local Traffic Manager 10.1.0 - 10.2.4", "product": { "name": "F5 BIG-IP Local Traffic Manager 10.1.0 - 10.2.4", "product_id": "T003382", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_local_traffic_manager:10.2.4" } } }, { "category": "product_name", "name": "F5 BIG-IP Local Traffic Manager 11.0.0 - 11.6.0", "product": { "name": "F5 BIG-IP Local Traffic Manager 11.0.0 - 11.6.0", "product_id": "T003681", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_local_traffic_manager:11.6.0" } } }, { "category": "product_name", "name": "F5 BIG-IP Local Traffic Manager 12.0.0", "product": { "name": "F5 BIG-IP Local Traffic Manager 12.0.0", "product_id": "T005927", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_local_traffic_manager:12.0.0" } } } ], "category": "product_name", "name": "big-ip_local_traffic_manager" }, { "branches": [ { "category": "product_name", "name": "F5 WAN Optimization Manager 11.0.0 - 11.3.0", "product": { "name": "F5 WAN Optimization Manager 11.0.0 - 11.3.0", "product_id": "269868", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_wan_optimization_manager:11.3.0" } } }, { "category": "product_name", "name": "F5 WAN Optimization Manager 10.1.0 - 10.2.4", "product": { "name": "F5 WAN Optimization Manager 10.1.0 - 10.2.4", "product_id": "T000535", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip_wan_optimization_manager:10.2.4" } } } ], "category": "product_name", "name": "big-ip_wan_optimization_manager" }, { "branches": [ { "category": "product_name", "name": "F5 WebAccelerator 10.1.0 - 10.2.4", "product": { "name": "F5 WebAccelerator 10.1.0 - 10.2.4", "product_id": "T001411", "product_identification_helper": { "cpe": "cpe:/h:f5:big-ip_webaccelerator:10.2.4" } } }, { "category": "product_name", "name": "F5 WebAccelerator 11.0.0 - 11.3.0", "product": { "name": "F5 WebAccelerator 11.0.0 - 11.3.0", "product_id": "T001412", "product_identification_helper": { "cpe": "cpe:/h:f5:big-ip_webaccelerator:11.3.0" } } } ], "category": "product_name", "name": "big-ip_webaccelerator" }, { "category": "product_name", "name": "F5 Enterprise Manager 3.0.0 - 3.1.1", "product": { "name": "F5 Enterprise Manager 3.0.0 - 3.1.1", "product_id": "269870", "product_identification_helper": { "cpe": "cpe:/a:f5:enterprise_manager:3.1.1" } } }, { "branches": [ { "category": "product_name", "name": "F5 BIG-IP Protocol Security Manager 10.1.0 - 10.2.4", "product": { "name": "F5 BIG-IP Protocol Security Manager 10.1.0 - 10.2.4", "product_id": "T001410", "product_identification_helper": { "cpe": "cpe:/a:f5:protocol_security_manager:10.2.4" } } }, { "category": "product_name", "name": "F5 BIG-IP Protocol Security Manager 11.0.0 - 11.4.1", "product": { "name": "F5 BIG-IP Protocol Security Manager 11.0.0 - 11.4.1", "product_id": "T003110", "product_identification_helper": { "cpe": "cpe:/a:f5:protocol_security_manager:11.4.1" } } } ], "category": "product_name", "name": "protocol_security_manager" } ], "category": "vendor", "name": "f5" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle MySQL Enterprise Monitor \u003c= 3.0.10", "product": { "name": "Oracle MySQL Enterprise Monitor \u003c= 3.0.10", "product_id": "T004853", "product_identification_helper": { "cpe": "cpe:/a:oracle:mysql_enterprise_monitor:3.0.10" } } }, { "category": "product_name", "name": "Oracle MySQL Enterprise Monitor \u003c= 3.0.18", "product": { "name": "Oracle MySQL Enterprise Monitor \u003c= 3.0.18", "product_id": "T004854", "product_identification_helper": { "cpe": "cpe:/a:oracle:mysql_enterprise_monitor:3.0.18" } } }, { "category": "product_name", "name": "Oracle MySQL Enterprise Monitor \u003c= 2.3.16", "product": { "name": "Oracle MySQL Enterprise Monitor \u003c= 2.3.16", "product_id": "T004855", "product_identification_helper": { "cpe": "cpe:/a:oracle:mysql_enterprise_monitor:2.3.16" } } }, { "category": "product_name", "name": "Oracle MySQL Enterprise Monitor \u003c= 2.3.19", "product": { "name": "Oracle MySQL Enterprise Monitor \u003c= 2.3.19", "product_id": "T004856", "product_identification_helper": { "cpe": "cpe:/a:oracle:mysql_enterprise_monitor:2.3.19" } } } ], "category": "product_name", "name": "mysql_enterprise_monitor" } ], "category": "vendor", "name": "oracle" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop 5", "product": { "name": "Red Hat Enterprise Linux Desktop 5", "product_id": "T000180", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux_desktop:5" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop 7", "product": { "name": "Red Hat Enterprise Linux Desktop 7", "product_id": "T003551", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux_desktop:7::desktop" } } } ], "category": "product_name", "name": "enterprise_linux_desktop" }, { "category": "product_name", "name": "Red Hat Enterprise Linux HPC Node 7", "product": { "name": "Red Hat Enterprise Linux HPC Node 7", "product_id": "T003549", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux_hpc_node:7" } } }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation 5", "product": { "name": "Red Hat Enterprise Linux Workstation 5", "product_id": "T000622", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux_workstation:5" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation 7", "product": { "name": "Red Hat Enterprise Linux Workstation 7", "product_id": "T003565", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux_workstation:7" } } } ], "category": "product_name", "name": "enterprise_linux_workstation" } ], "category": "vendor", "name": "redhat" } ] }, "vulnerabilities": [ { "cve": "CVE-2014-0112", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2014-0112" }, { "cve": "CVE-2014-3569", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2014-3569" }, { "cve": "CVE-2014-7809", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2014-7809" }, { "cve": "CVE-2015-0405", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0405" }, { "cve": "CVE-2015-0423", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0423" }, { "cve": "CVE-2015-0433", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0433" }, { "cve": "CVE-2015-0438", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0438" }, { "cve": "CVE-2015-0439", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0439" }, { "cve": "CVE-2015-0441", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0441" }, { "cve": "CVE-2015-0498", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0498" }, { "cve": "CVE-2015-0499", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0499" }, { "cve": "CVE-2015-0500", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0500" }, { "cve": "CVE-2015-0501", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0501" }, { "cve": "CVE-2015-0503", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0503" }, { "cve": "CVE-2015-0505", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0505" }, { "cve": "CVE-2015-0506", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0506" }, { "cve": "CVE-2015-0507", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0507" }, { "cve": "CVE-2015-0508", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0508" }, { "cve": "CVE-2015-0511", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-0511" }, { "cve": "CVE-2015-2566", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-2566" }, { "cve": "CVE-2015-2567", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-2567" }, { "cve": "CVE-2015-2568", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-2568" }, { "cve": "CVE-2015-2571", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-2571" }, { "cve": "CVE-2015-2573", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-2573" }, { "cve": "CVE-2015-2575", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-2575" }, { "cve": "CVE-2015-2576", "notes": [ { "category": "description", "text": "In verschiedenen Komponenten von Oracle MySQL existieren insgesamt 26 nicht n\u00e4her beschriebene Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"Complete\" f\u00fcr \"Integrity\", \"Availability\" und \"Confidentiality\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T003343", "269868", "T003303", "T003549", "T005927", "T005928", "269870", "T005086", "T003382", "T000180", "269856", "T004467", "T000548", "2951", "T002207", "T000622", "120737", "T000541", "307369", "122559", "T023087", "T003681", "T003683", "T003684", "T004850", "T004851", "T003565", "T003686", "T004852", "T003687", "T004853", "T004854", "T004855", "T004856", "T004857", "T000535", "T000179", "199182", "T003110", "T003550", "T003551", "T005932", "T003633", "T005931", "241405", "T005938", "T000523", "T001412", "T001411", "T001410" ] }, "release_date": "2015-04-14T22:00:00Z", "title": "CVE-2015-2576" } ] }
ghsa-prjv-jj26-wf8h
Vulnerability from github
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
{ "affected": [ { "package": { "ecosystem": "Maven", "name": "org.apache.struts:struts2-core" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.3.20" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2014-0112" ], "database_specific": { "cwe_ids": [], "github_reviewed": true, "github_reviewed_at": "2022-11-03T22:57:46Z", "nvd_published_at": "2014-04-29T10:37:00Z", "severity": "HIGH" }, "details": "ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.", "id": "GHSA-prjv-jj26-wf8h", "modified": "2023-12-28T19:02:21Z", "published": "2022-05-14T00:54:16Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0112" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:0910" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1091939" }, { "type": "WEB", "url": "https://cwiki.apache.org/confluence/display/WW/S2-021" }, { "type": "PACKAGE", "url": "https://github.com/apache/struts" }, { "type": "WEB", "url": "http://jvn.jp/en/jp/JVN19294237/index.html" }, { "type": "WEB", "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html" }, { "type": "WEB", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676706" }, { "type": "WEB", "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html" }, { "type": "WEB", "url": "http://www.vmware.com/security/advisories/VMSA-2014-0007.html" } ], "schema_version": "1.4.0", "severity": [], "summary": "ClassLoader manipulation in Apache Struts" }
rhsa-2019_0910
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A minor version update (from 7.2 to 7.3) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "This release of Red Hat Fuse 7.3 serves as a replacement for Red Hat Fuse 7.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* jackson-databind: A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. (CVE-2017-7525)\n\n* struts2: ClassLoader manipulation via request parameters (CVE-2014-0112)\n\n* jetty: HTTP request smuggling (CVE-2017-7657)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:0910", "url": "https://access.redhat.com/errata/RHSA-2019:0910" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.fuse\u0026version=7.3.0", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.fuse\u0026version=7.3.0" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/html-single/release_notes/", "url": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/html-single/release_notes/" }, { "category": "external", "summary": "1091939", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1091939" }, { "category": "external", "summary": "1462702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1462702" }, { "category": "external", "summary": "1595620", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595620" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0910.json" } ], "title": "Red Hat Security Advisory: Red Hat Fuse 7.3 security update", "tracking": { "current_release_date": "2024-11-05T21:03:56+00:00", "generator": { "date": "2024-11-05T21:03:56+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2019:0910", "initial_release_date": "2019-04-30T15:18:16+00:00", "revision_history": [ { "date": "2019-04-30T15:18:16+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-04-30T15:18:16+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T21:03:56+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Fuse 7.3", "product": { "name": "Red Hat Fuse 7.3", "product_id": "Red Hat Fuse 7.3", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_fuse:7" } } } ], "category": "product_family", "name": "Red Hat JBoss Fuse" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2014-0112", "discovery_date": "2014-04-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1091939" } ], "notes": [ { "category": "description", "text": "ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.", "title": "Vulnerability description" }, { "category": "summary", "text": "struts2: ClassLoader manipulation via request parameters", "title": "Vulnerability summary" }, { "category": "other", "text": "A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped, used, or enabled in any Red Hat provided final products, and does not cause any vulnerability in the product, struts2-core jars have been included in some products\u0027 source code packages. The inclusion was part of an import of the Google Guice repository, which includes struts2-core. Customers that build artefacts from our source code could be at risk. Red Hat will remove these artefacts from source code in future releases.\n\nThe products that included the Struts 2 artefacts in their source jars:\nFuse Service Works 6.0.0\nSingle Sign On 7.3.0+\n\nIf you have used the source package from one of these products to build artefacts on your system, you should do the following to remove potentially affected jars:\n1. Run \u0027find . -name struts2*.jar\u0027 under the source location\n2. Remove any files found\nThis will not affect the product, as the jar is included with the source of google-guice, but no functionality requiring struts2 is implemented.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.3" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2014-0112" }, { "category": "external", "summary": "RHBZ#1091939", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1091939" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0112", "url": "https://www.cve.org/CVERecord?id=CVE-2014-0112" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0112", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0112" }, { "category": "external", "summary": "https://cwiki.apache.org/confluence/display/WW/S2-021", "url": "https://cwiki.apache.org/confluence/display/WW/S2-021" } ], "release_date": "2014-04-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-30T15:18:16+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are available from the Fuse 7.3.0 product documentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/", "product_ids": [ "Red Hat Fuse 7.3" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0910" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "Red Hat Fuse 7.3" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "struts2: ClassLoader manipulation via request parameters" }, { "acknowledgments": [ { "names": [ "Liao Xinxi" ], "organization": "NSFOCUS" } ], "cve": "CVE-2017-7525", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2017-06-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1462702" } ], "notes": [ { "category": "description", "text": "A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1) and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as shipped with Red Hat Satellite 6.x. However the affected code is NOT used at this time:\n\nCandlepin currently uses the default type resolution configuration for the ObjectMappers it creates/uses. Nowhere in candlepin do we enable global polymorphic deserialization via enableDefaultTyping(...), therefore based on the documentation sited BZ 1462702 , candlepin should not be affected.\n\nHowever as the vulnerable software ships with the product we have marked them as vulnerable to ensure the issue is tracked.\n\nJBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling and unmarshalling of JSON objects passed to JAX-RS webservices. Some advise about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is available here: \n\nhttps://access.redhat.com/solutions/3279231\n\nAlthough JBoss Fuse ships the vulnerable version of jackson-databind, it does not call on enableDefaultTyping() for any polymorphic deserialization operations which is the root cause of this vulnerability. We have raised a Jira tracker to ensure that jackson-databind will be upgraded for Fuse 7.0, however due to feasibility issues jackson-databind cannot be upgraded in JBoss Fuse 6.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.3" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2017-7525" }, { "category": "external", "summary": "RHBZ#1462702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1462702" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2017-7525", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7525" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7525", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7525" } ], "release_date": "2017-07-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-30T15:18:16+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are available from the Fuse 7.3.0 product documentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/", "product_ids": [ "Red Hat Fuse 7.3" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0910" }, { "category": "workaround", "details": "Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true", "product_ids": [ "Red Hat Fuse 7.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "Red Hat Fuse 7.3" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper" }, { "cve": "CVE-2017-7657", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2018-06-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1595620" } ], "notes": [ { "category": "description", "text": "In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.", "title": "Vulnerability description" }, { "category": "summary", "text": "jetty: HTTP request smuggling", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of jetty embedded in the nutch package as shipped with Red Hat Satellite 5. The nutch service is not exposed, as such exploitation is difficult, Red Hat Product Security has rated this issue as having security impact of Low. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.\n\nData Grid 7 has deprecated the agent-bond utility that permits this flaw; it is disabled by default and is no longer supported. While the functionality is still available for backward-compatibility usage, customers are strongly recommended to use Prometheus JMX instead. As the functionality is deprecated and no longer supported, the flaw has been scored as Moderate for Data Grid 7.\n\nData Grid 8 is not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.3" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2017-7657" }, { "category": "external", "summary": "RHBZ#1595620", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595620" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2017-7657", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7657" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7657", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7657" } ], "release_date": "2018-06-07T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-30T15:18:16+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are available from the Fuse 7.3.0 product documentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/", "product_ids": [ "Red Hat Fuse 7.3" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0910" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "Red Hat Fuse 7.3" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jetty: HTTP request smuggling" }, { "cve": "CVE-2019-0194", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2019-04-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1707581" } ], "notes": [ { "category": "description", "text": "Apache Camel\u0027s File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also affected.", "title": "Vulnerability description" }, { "category": "summary", "text": "camel: Directory traversal in file producer", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Fuse 7.3" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0194" }, { "category": "external", "summary": "RHBZ#1707581", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1707581" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0194", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0194" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0194", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0194" } ], "release_date": "2019-04-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-30T15:18:16+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are available from the Fuse 7.3.0 product documentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/", "product_ids": [ "Red Hat Fuse 7.3" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0910" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "Red Hat Fuse 7.3" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "camel: Directory traversal in file producer" } ] }
gsd-2014-0112
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2014-0112", "description": "ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.", "id": "GSD-2014-0112", "references": [ "https://www.suse.com/security/cve/CVE-2014-0112.html", "https://access.redhat.com/errata/RHSA-2019:0910", "https://packetstormsecurity.com/files/cve/CVE-2014-0112" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2014-0112" ], "details": "ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.", "id": "GSD-2014-0112", "modified": "2023-12-13T01:22:44.977206Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2014-0112", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html" }, { "name": "https://cwiki.apache.org/confluence/display/WW/S2-021", "refsource": "CONFIRM", "url": "https://cwiki.apache.org/confluence/display/WW/S2-021" }, { "name": "59178", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/59178" }, { "name": "http://www.vmware.com/security/advisories/VMSA-2014-0007.html", "refsource": "CONFIRM", "url": "http://www.vmware.com/security/advisories/VMSA-2014-0007.html" }, { "name": "20140426 [ANN] Struts 2.3.16.2 GA release available - security fix", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/531952/100/0/threaded" }, { "name": "59500", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/59500" }, { "name": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html" }, { "name": "67064", "refsource": "BID", "url": "http://www.securityfocus.com/bid/67064" }, { "name": "JVN#19294237", "refsource": "JVN", "url": "http://jvn.jp/en/jp/JVN19294237/index.html" }, { "name": "JVNDB-2014-000045", "refsource": "JVNDB", "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045" }, { "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676706", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676706" }, { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1091939", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1091939" }, { "name": "20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/532549/100/0/threaded" }, { "name": "RHSA-2019:0910", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:0910" } ] } }, "gitlab.com": { "advisories": [ { "affected_range": "(,2.3.16.1]", "affected_versions": "All versions up to 2.3.16.1", "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "cwe_ids": [ "CWE-1035", "CWE-264", "CWE-937" ], "date": "2019-08-12", "description": "This package does not properly restrict access to the getClass method, which allows remote attackers to `manipulate` the `ClassLoader` and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.", "fixed_versions": [ "2.3.16.2" ], "identifier": "CVE-2014-0112", "identifiers": [ "CVE-2014-0112" ], "not_impacted": "All versions after 2.3.16.1", "package_slug": "maven/org.apache.struts/struts2-core", "pubdate": "2014-04-29", "solution": "Upgrade to version 2.3.16.2 or above.", "title": "Incomplete fix for ClassLoader manipulation via ParametersInterceptor", "urls": [ "http://struts.apache.org/docs/s2-021.html", "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0112" ], "uuid": "f4bb6ebc-12cd-447c-bb81-dd3cc6c3b9be" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "2.3.16.2", "versionStartIncluding": "2.0.0", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2014-0112" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-264" } ] } ] }, "references": { "reference_data": [ { "name": "JVNDB-2014-000045", "refsource": "JVNDB", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045" }, { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1091939", "refsource": "CONFIRM", "tags": [ "Issue Tracking" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1091939" }, { "name": "JVN#19294237", "refsource": "JVN", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://jvn.jp/en/jp/JVN19294237/index.html" }, { "name": "https://cwiki.apache.org/confluence/display/WW/S2-021", "refsource": "CONFIRM", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://cwiki.apache.org/confluence/display/WW/S2-021" }, { "name": "59500", "refsource": "SECUNIA", "tags": [ "Permissions Required" ], "url": "http://secunia.com/advisories/59500" }, { "name": "http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html", "refsource": "MISC", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html" }, { "name": "http://www.vmware.com/security/advisories/VMSA-2014-0007.html", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "http://www.vmware.com/security/advisories/VMSA-2014-0007.html" }, { "name": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html" }, { "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676706", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676706" }, { "name": "67064", "refsource": "BID", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/bid/67064" }, { "name": "59178", "refsource": "SECUNIA", "tags": [ "Permissions Required" ], "url": "http://secunia.com/advisories/59178" }, { "name": "20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library", "refsource": "BUGTRAQ", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/archive/1/532549/100/0/threaded" }, { "name": "20140426 [ANN] Struts 2.3.16.2 GA release available - security fix", "refsource": "BUGTRAQ", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/archive/1/531952/100/0/threaded" }, { "name": "RHSA-2019:0910", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:0910" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false } }, "lastModifiedDate": "2019-08-12T21:15Z", "publishedDate": "2014-04-29T10:37Z" } } }
var-201404-0286
Vulnerability from variot
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094. Apache Struts provided by the Apache Software Foundation is a software framework for creating Java web applications. Apache Struts contains a vulnerability where the ClassLoader may be manipulated. NTT-CERT reported this vulnerability to IPA. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. Summary:
A minor version update (from 7.2 to 7.3) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description:
This release of Red Hat Fuse 7.3 serves as a replacement for Red Hat Fuse 7.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
-
jackson-databind: A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. (CVE-2017-7525)
-
struts2: ClassLoader manipulation via request parameters (CVE-2014-0112)
-
jetty: HTTP request smuggling (CVE-2017-7657)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Solution:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Installation instructions are available from the Fuse 7.3.0 product documentation page: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/
- Bugs fixed (https://bugzilla.redhat.com/):
1091939 - CVE-2014-0112 struts2: ClassLoader manipulation via request parameters 1462702 - CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper 1595620 - CVE-2017-7657 jetty: HTTP request smuggling
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
VMware Security Advisory
Advisory ID: VMSA-2014-0007 Synopsis: VMware product updates address security vulnerabilities in Apache Struts library Issue date: 2014-06-24 Updated on: 2014-06-24 (Initial Advisory) CVE number: CVE-2014-0050, CVE-2014-0094, CVE-2014-0112
-
Summary
VMware product updates address security vulnerabilities in Apache Struts library
-
Relevant releases
VMware vCenter Operations Management Suite prior to 5.8.2
-
Problem Description
a. The Apache Struts library is updated to version 2.3.16.2 to address multiple security issues.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2014-0050, CVE-2014-0094, and
CVE-2014-0112 to these issues.
CVE-2014-0112 may lead to remote code execution. This issue was
found to be only partially addressed in CVE-2014-0094.
CVE-2014-0050 may lead to a denial of service condition.
vCenter Operations Management Suite (vCOps) is affected by both
CVE-2014-0112 and CVE-2014-0050. Exploitation of CVE-2014-0112
may lead to remote code execution without authentication.
vCenter Orchestrator (vCO) is affected by CVE-2014-0050 and not
by CVE-2014-0112.
Workaround
A workaround for CVE-2014-0112 is documented in VMware Knowledge Base
article 2081470.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======= ======= =================
vCOPS 5.8.x any vCOPS 5.8.2
vCOPS 5.7.x any patch pending *
vCO 5.5 any patch pending
vCO 5.1 any patch pending
vCO 4.2 any patch pending
*Customers are advised to apply the workaround or update to vCOps
5.8.2.
- Solution
Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.
vCenter Operations Management Suite 5.8.2
Downloads and Documentation: https://www.vmware.com/go/download-vcops
- References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0050 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0094 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0112
http://kb.vmware.com/kb/2081470
- Change log
2014-06-24 VMSA-2014-0007 Initial security advisory in conjunction with the release of vCenter Operations Management Suite 5.8.2 on 2014-06-24.
- Contact
E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories http://www.vmware.com/security/advisories
VMware Security Response Policy https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases https://www.vmware.com/support/policies/lifecycle.html
Twitter https://twitter.com/VMwareSRC
Copyright 2014 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE----- Version: Encryption Desktop 10.3.2 (Build 15337) Charset: utf-8
wj8DBQFTqi0BDEcm8Vbi9kMRAnCKAJ9otVO7DlXuMnSEGh2TLBzS5hniKgCeMnAM CZ5+DYZAydCjMwVgtKqoo7Y= =Vwu5 -----END PGP SIGNATURE-----
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201404-0286", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "struts", "scope": "gte", "trust": 1.0, "vendor": "apache", "version": "2.0.0" }, { "model": "struts", "scope": "lt", "trust": 1.0, "vendor": "apache", "version": "2.3.16.2" }, { "model": "struts", "scope": "eq", "trust": 0.8, "vendor": "apache", "version": "2.0.0 to 2.3.16.1" }, { "model": "asianux server", "scope": "eq", "trust": 0.8, "vendor": "cybertrust", "version": "3 for x86(32bit)" }, { "model": "asianux server", "scope": "eq", "trust": 0.8, "vendor": "cybertrust", "version": "3 for x86_64(64bit)" }, { "model": "cloud infrastructure management software", "scope": null, "trust": 0.8, "vendor": "fujitsu", "version": null }, { "model": "integrated system ha database ready", "scope": null, "trust": 0.8, "vendor": "fujitsu", "version": null }, { "model": "interstage", "scope": "eq", "trust": 0.8, "vendor": "fujitsu", "version": "business analytics modeling server" }, { "model": "interstage", "scope": "eq", "trust": 0.8, "vendor": "fujitsu", "version": "business process manager analytics" }, { "model": "interstage", "scope": "eq", "trust": 0.8, "vendor": "fujitsu", "version": "extreme transaction processing server" }, { "model": "interstage", "scope": "eq", "trust": 0.8, "vendor": "fujitsu", "version": "mobile manager" }, { "model": "interstage application development cycle manager", "scope": null, "trust": 0.8, "vendor": "fujitsu", "version": null }, { "model": "interstage application framework suite", "scope": null, "trust": 0.8, "vendor": "fujitsu", "version": null }, { "model": "interstage application server", "scope": null, "trust": 0.8, "vendor": "fujitsu", "version": null }, { "model": "interstage apworks", "scope": null, "trust": 0.8, "vendor": "fujitsu", "version": null }, { "model": "interstage business application server", "scope": null, "trust": 0.8, "vendor": "fujitsu", "version": null }, { "model": "interstage interaction manager", "scope": null, "trust": 0.8, "vendor": "fujitsu", "version": null }, { "model": "interstage job workload server", "scope": null, "trust": 0.8, "vendor": "fujitsu", "version": null }, { "model": "interstage service integrator", "scope": null, "trust": 0.8, "vendor": "fujitsu", "version": null }, { "model": "interstage studio", "scope": null, "trust": 0.8, "vendor": "fujitsu", "version": null }, { "model": "serverview", "scope": "eq", "trust": 0.8, "vendor": "fujitsu", "version": "resource orchestrator" }, { "model": "symfoware", "scope": "eq", "trust": 0.8, "vendor": "fujitsu", "version": "analytics server" }, { "model": "symfoware", "scope": "eq", "trust": 0.8, "vendor": "fujitsu", "version": "server" }, { "model": "systemwalker service catalog manager", "scope": null, "trust": 0.8, "vendor": "fujitsu", "version": null }, { "model": "systemwalker service quality coordinator", "scope": null, "trust": 0.8, "vendor": "fujitsu", "version": null }, { "model": "systemwalker software configuration manager", "scope": null, "trust": 0.8, "vendor": "fujitsu", "version": null }, { "model": "triole", "scope": "eq", "trust": 0.8, "vendor": "fujitsu", "version": "cloudmiddleset b set" }, { "model": "struts", "scope": "eq", "trust": 0.6, "vendor": "apache", "version": "2.3.8" }, { "model": "struts", "scope": "eq", "trust": 0.6, "vendor": "apache", "version": "2.3.7" }, { "model": "struts", "scope": "eq", "trust": 0.6, "vendor": "apache", "version": "2.3.14.1" }, { "model": "struts", "scope": "eq", "trust": 0.6, "vendor": "apache", "version": "2.3.14" }, { "model": "struts", "scope": "eq", "trust": 0.6, "vendor": "apache", "version": "2.3.4.1" }, { "model": "struts", "scope": "eq", "trust": 0.6, "vendor": "apache", "version": "2.3.14.3" }, { "model": "struts", "scope": "eq", "trust": 0.6, "vendor": "apache", "version": "2.3.16.1" }, { "model": "struts", "scope": "eq", "trust": 0.6, "vendor": "apache", "version": "2.3.15" }, { "model": "struts", "scope": "eq", "trust": 0.6, "vendor": "apache", "version": "2.3.4" }, { "model": "struts", "scope": "eq", "trust": 0.6, "vendor": "apache", "version": "2.3.14.2" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.2.3" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.2" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.1.8" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.1.6" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.1.5" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.1.2" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.1.1" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.1" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.0.14" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.0.12" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.0.11" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.0.10" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.0.9" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.0.8" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.0.7" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.0.6" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.0.5" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.0.4" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.0.3" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.0.2" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.0.1" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.0" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.3.1.2" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.3.1.1" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.2.3.1" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.1.4" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.1.3" }, { "model": "software foundation struts", "scope": "eq", "trust": 0.3, "vendor": "apache", "version": "2.0.13" } ], "sources": [ { "db": "BID", "id": "67064" }, { "db": "JVNDB", "id": "JVNDB-2014-000045" }, { "db": "CNNVD", "id": "CNNVD-201404-445" }, { "db": "NVD", "id": "CVE-2014-0112" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "2.3.16.2", "versionStartIncluding": "2.0.0", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2014-0112" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Red Hat", "sources": [ { "db": "PACKETSTORM", "id": "152687" }, { "db": "CNNVD", "id": "CNNVD-201404-445" } ], "trust": 0.7 }, "cve": "CVE-2014-0112", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 10.0, "impactScore": 6.4, "integrityImpact": "PARTIAL", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Network", "authentication": "None", "author": "IPA", "availabilityImpact": "Partial", "baseScore": 7.5, "confidentialityImpact": "Partial", "exploitabilityScore": null, "id": "JVNDB-2014-000045", "impactScore": null, "integrityImpact": "Partial", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "High", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULMON", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 10.0, "id": "CVE-2014-0112", "impactScore": 6.4, "integrityImpact": "PARTIAL", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "HIGH", "trust": 0.1, "userInteractionRequired": null, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" } ], "cvssV3": [], "severity": [ { "author": "NVD", "id": "CVE-2014-0112", "trust": 1.0, "value": "HIGH" }, { "author": "IPA", "id": "JVNDB-2014-000045", "trust": 0.8, "value": "High" }, { "author": "CNNVD", "id": "CNNVD-201404-445", "trust": 0.6, "value": "HIGH" }, { "author": "VULMON", "id": "CVE-2014-0112", "trust": 0.1, "value": "HIGH" } ] } ], "sources": [ { "db": "VULMON", "id": "CVE-2014-0112" }, { "db": "JVNDB", "id": "JVNDB-2014-000045" }, { "db": "CNNVD", "id": "CNNVD-201404-445" }, { "db": "NVD", "id": "CVE-2014-0112" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094. Apache Struts provided by the Apache Software Foundation is a software framework for creating Java web applications. Apache Struts contains a vulnerability where the ClassLoader may be manipulated. NTT-CERT reported this vulnerability to IPA. \nAn attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. Summary:\n\nA minor version update (from 7.2 to 7.3) is now available for Red Hat Fuse. \nThe purpose of this text-only errata is to inform you about the security\nissues fixed in this release. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. Description:\n\nThis release of Red Hat Fuse 7.3 serves as a replacement for Red Hat Fuse\n7.2, and includes bug fixes and enhancements, which are documented in the\nRelease Notes document linked to in the References. \n\nSecurity Fix(es):\n\n* jackson-databind: A deserialization flaw was discovered in the\njackson-databind which could allow an unauthenticated user to perform code\nexecution by sending the maliciously crafted input to the readValue method\nof the ObjectMapper. (CVE-2017-7525)\n\n* struts2: ClassLoader manipulation via request parameters (CVE-2014-0112)\n\n* jetty: HTTP request smuggling (CVE-2017-7657)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section. Solution:\n\nBefore applying the update, back up your existing installation, including\nall applications, configuration files, databases and database settings, and\nso on. \n\nInstallation instructions are available from the Fuse 7.3.0 product\ndocumentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1091939 - CVE-2014-0112 struts2: ClassLoader manipulation via request parameters\n1462702 - CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper\n1595620 - CVE-2017-7657 jetty: HTTP request smuggling\n\n5. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n- ------------------------------------------------------------------------\n VMware Security Advisory\n\nAdvisory ID: VMSA-2014-0007\nSynopsis: VMware product updates address security vulnerabilities in \n Apache Struts library \nIssue date: 2014-06-24\nUpdated on: 2014-06-24 (Initial Advisory)\nCVE number: CVE-2014-0050, CVE-2014-0094, CVE-2014-0112\n- ------------------------------------------------------------------------\n\n1. Summary\n\n VMware product updates address security vulnerabilities in Apache \n Struts library\n\n2. Relevant releases\n\n VMware vCenter Operations Management Suite prior to 5.8.2\n\n3. Problem Description\n\n a. The Apache Struts library is updated to version 2.3.16.2 to \n address multiple security issues. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org)\n has assigned the names CVE-2014-0050, CVE-2014-0094, and\n CVE-2014-0112 to these issues. \n\n CVE-2014-0112 may lead to remote code execution. This issue was \n found to be only partially addressed in CVE-2014-0094. \n\n CVE-2014-0050 may lead to a denial of service condition. \n\n vCenter Operations Management Suite (vCOps) is affected by both \n CVE-2014-0112 and CVE-2014-0050. Exploitation of CVE-2014-0112\n may lead to remote code execution without authentication. \n\n vCenter Orchestrator (vCO) is affected by CVE-2014-0050 and not \n by CVE-2014-0112. \n\n Workaround\n\n A workaround for CVE-2014-0112 is documented in VMware Knowledge Base\n article 2081470. \n\n\n Column 4 of the following table lists the action required to\n remediate the vulnerability in each release, if a solution is \n available. \n\n VMware Product\tRunning\tReplace with/\n Product Version\ton\tApply Patch\n ============= =======\t=======\t=================\n vCOPS\t 5.8.x \tany \tvCOPS 5.8.2\n vCOPS 5.7.x any patch pending *\n\n vCO 5.5 any patch pending\n vCO 5.1 any patch pending\n vCO 4.2 any patch pending\n\n *Customers are advised to apply the workaround or update to vCOps\n5.8.2. \n\n4. Solution\n\n Please review the patch/release notes for your product and version \n and verify the checksum of your downloaded file. \n\n vCenter Operations Management Suite 5.8.2\n -----------------------------------------\n Downloads and Documentation:\n https://www.vmware.com/go/download-vcops\n \n5. References\n\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0050\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0094\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0112\n\n http://kb.vmware.com/kb/2081470\n\n- ------------------------------------------------------------------------\n\n6. Change log\n\n 2014-06-24 VMSA-2014-0007\n Initial security advisory in conjunction with the release of vCenter\n Operations Management Suite 5.8.2 on 2014-06-24. \n\n- ------------------------------------------------------------------------\n\n7. Contact\n\n E-mail list for product security notifications and announcements:\n http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce\n\n This Security Advisory is posted to the following lists:\n\n security-announce at lists.vmware.com\n bugtraq at securityfocus.com\n fulldisclosure at seclists.org\n\n E-mail: security at vmware.com\n PGP key at: http://kb.vmware.com/kb/1055\n\n VMware Security Advisories\n http://www.vmware.com/security/advisories\n\n VMware Security Response Policy\n https://www.vmware.com/support/policies/security_response.html\n\n VMware Lifecycle Support Phases\n https://www.vmware.com/support/policies/lifecycle.html\n \n Twitter\n https://twitter.com/VMwareSRC\n\n Copyright 2014 VMware Inc. All rights reserved. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: Encryption Desktop 10.3.2 (Build 15337)\nCharset: utf-8\n\nwj8DBQFTqi0BDEcm8Vbi9kMRAnCKAJ9otVO7DlXuMnSEGh2TLBzS5hniKgCeMnAM\nCZ5+DYZAydCjMwVgtKqoo7Y=\n=Vwu5\n-----END PGP SIGNATURE-----\n", "sources": [ { "db": "NVD", "id": "CVE-2014-0112" }, { "db": "JVNDB", "id": "JVNDB-2014-000045" }, { "db": "BID", "id": "67064" }, { "db": "VULMON", "id": "CVE-2014-0112" }, { "db": "PACKETSTORM", "id": "152687" }, { "db": "PACKETSTORM", "id": "127215" } ], "trust": 2.16 }, "exploit_availability": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=33142", "trust": 0.2, "type": "exploit" } ], "sources": [ { "db": "VULMON", "id": "CVE-2014-0112" } ] }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2014-0112", "trust": 3.0 }, { "db": "JVN", "id": "JVN19294237", "trust": 2.5 }, { "db": "JVNDB", "id": "JVNDB-2014-000045", "trust": 2.5 }, { "db": "BID", "id": "67064", "trust": 2.0 }, { "db": "PACKETSTORM", "id": "127215", "trust": 1.8 }, { "db": "SECUNIA", "id": "59500", "trust": 1.7 }, { "db": "SECUNIA", "id": "59178", "trust": 1.7 }, { "db": "CERT/CC", "id": "VU#719225", "trust": 0.8 }, { "db": "PACKETSTORM", "id": "152687", "trust": 0.7 }, { "db": "AUSCERT", "id": "ESB-2019.1493", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-201404-445", "trust": 0.6 }, { "db": "EXPLOITDB", "id": "33142", "trust": 0.1 }, { "db": "VULMON", "id": "CVE-2014-0112", "trust": 0.1 } ], "sources": [ { "db": "VULMON", "id": "CVE-2014-0112" }, { "db": "BID", "id": "67064" }, { "db": "JVNDB", "id": "JVNDB-2014-000045" }, { "db": "PACKETSTORM", "id": "152687" }, { "db": "PACKETSTORM", "id": "127215" }, { "db": "CNNVD", "id": "CNNVD-201404-445" }, { "db": "NVD", "id": "CVE-2014-0112" } ] }, "id": "VAR-201404-0286", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VARIoT devices database", "id": null } ], "trust": 0.1875 }, "last_update_date": "2024-04-19T20:14:12.803000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Announcements - 2013 24 April 2014 - Struts up to 2.3.16.1: Zero-Day Exploit Mitigation", "trust": 0.8, "url": "http://struts.apache.org/announce.html#a20140424" }, { "title": "Security Bulletins S2-020", "trust": 0.8, "url": "http://struts.apache.org/release/2.3.x/docs/s2-020.html" }, { "title": "Security Bulletins S2-021", "trust": 0.8, "url": "http://struts.apache.org/release/2.3.x/docs/s2-021.html" }, { "title": "Download a Release of Apache Struts -- Full Releases Struts 2.3.16.2", "trust": 0.8, "url": "http://struts.apache.org/download.cgi#struts23162" }, { "title": "struts-1.2.9-4jpp.8.AXS3 ", "trust": 0.8, "url": "https://tsn.miraclelinux.com/tsn_local/index.php?m=errata\u0026a=detail\u0026eid=3678\u0026stype=\u0026sproduct=\u0026published=1" }, { "title": "Interstage Application Development Cycle Manager(ADM): Apache Struts vulnerable (CVE-2014-0094)", "trust": 0.8, "url": "http://software.fujitsu.com/jp/security/products-fujitsu/solution/interstage_aplidevcyclemgr_201401.html" }, { "title": "CVE-2014-0094, CVE-2014-0114: Apache Struts vulnerable to ClassLoader manipulation", "trust": 0.8, "url": "http://www.fujitsu.com/global/support/products/software/security/products-f/cve2014-0094-0114e.html" }, { "title": "Interstage Business Process Manager Analytics, Systemwalker Service Quality Coordinator: Vulnerability of allowing attackers to \"manipulate\" the ClassLoader (CVE-2014-0094). May 20th, 2014", "trust": 0.8, "url": "http://www.fujitsu.com/global/support/products/software/security/products-f/interstage-bpma201401e.html" }, { "title": "Symfoware Server (Open Interface) : Security vulnerabilities of Struts (CVE-2014-0094, CVE-2014-0112, CVE-2014-0113, CVE-2014-0116)", "trust": 0.8, "url": "http://software.fujitsu.com/jp/security/products-fujitsu/solution/symfoware_201402.html" }, { "title": "Interstage Interaction Manager: Struts1 vulnerability (CVE-2014-0094)", "trust": 0.8, "url": "http://software.fujitsu.com/jp/security/products-fujitsu/solution/interstage_im_201401.html" }, { "title": "Interstage Mobile Manager: Struts1 vulnerability (CVE-2014-0094)", "trust": 0.8, "url": "http://software.fujitsu.com/jp/security/products-fujitsu/solution/interstage_mm_201401.html" }, { "title": "FUJITSU Integrated System HA Database Ready: Struts2 vulnerabilities (CVE-2014-0094,CVE-2014-0112,CVE-2014-0113,CVE-2014-0116)", "trust": 0.8, "url": "http://software.fujitsu.com/jp/security/products-fujitsu/solution/ha_db_ready_201401.html" }, { "title": "1680848", "trust": 0.8, "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21680848" }, { "title": "1681190", "trust": 0.8, "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681190" }, { "title": "2081470", "trust": 0.8, "url": "http://kb.vmware.com/selfservice/microsites/search.do?language=en_us\u0026cmd=displaykc\u0026externalid=2081470" }, { "title": "NV15-001", "trust": 0.8, "url": "http://jpn.nec.com/security-info/secinfo/nv15-001.html" }, { "title": "Oracle Critical Patch Update Advisory - April 2015", "trust": 0.8, "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html" }, { "title": "Text Form of Oracle Critical Patch Update - April 2015 Risk Matrices", "trust": 0.8, "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015verbose-2365613.html" }, { "title": "Bug 1091939", "trust": 0.8, "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1091939" }, { "title": "Huawei-SA-20140707-01-Struts2", "trust": 0.8, "url": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm" }, { "title": "April 2015 Critical Patch Update Released", "trust": 0.8, "url": "https://blogs.oracle.com/security/entry/april_2015_critical_patch_update" }, { "title": "Alert/Advisory: Multiple Vulnerabilities in Apache Struts on Trend Micro Products", "trust": 0.8, "url": "http://esupport.trendmicro.com/solution/ja-jp/1103321.aspx" }, { "title": "VMSA-2014-0007", "trust": 0.8, "url": "http://www.vmware.com/security/advisories/vmsa-2014-0007.html" }, { "title": "Red Hat: Important: Red Hat Fuse 7.3 security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20190910 - security advisory" }, { "title": "Red Hat: CVE-2014-0112", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=cve-2014-0112" }, { "title": "VMware Security Advisories: VMware product updates address security vulnerabilities in Apache Struts library", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=vmware_security_advisories\u0026qid=3f8f92a767d3e2773247be2d5077cbee" }, { "title": "Oracle: Oracle Critical Patch Update Advisory - April 2015", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=4b527561ba1a5de7a529c8a93679f585" }, { "title": "strutt-cve-2014-0114", "trust": 0.1, "url": "https://github.com/anob3it/strutt-cve-2014-0114 " }, { "title": "-maven-security-versions", "trust": 0.1, "url": "https://github.com/nagauker/-maven-security-versions " }, { "title": "maven-security-versions-Travis", "trust": 0.1, "url": "https://github.com/klee94/maven-security-versions-travis " }, { "title": "maven-security-versions", "trust": 0.1, "url": "https://github.com/victims/maven-security-versions " }, { "title": "victims", "trust": 0.1, "url": "https://github.com/tmpgit3000/victims " }, { "title": "victims", "trust": 0.1, "url": "https://github.com/alexsh88/victims " }, { "title": "Threatpost", "trust": 0.1, "url": "https://threatpost.com/vmware-patches-apache-struts-flaws-in-vcops/106858/" } ], "sources": [ { "db": "VULMON", "id": "CVE-2014-0112" }, { "db": "JVNDB", "id": "JVNDB-2014-000045" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-264", "trust": 1.0 }, { "problemtype": "CWE-DesignError", "trust": 0.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2014-000045" }, { "db": "NVD", "id": "CVE-2014-0112" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.5, "url": "http://jvn.jp/en/jp/jvn19294237/index.html" }, { "trust": 2.5, "url": "https://access.redhat.com/errata/rhsa-2019:0910" }, { "trust": 2.4, "url": "http://www.securityfocus.com/bid/67064" }, { "trust": 2.3, "url": "http://packetstormsecurity.com/files/127215/vmware-security-advisory-2014-0007.html" }, { "trust": 2.3, "url": "http://www.vmware.com/security/advisories/vmsa-2014-0007.html" }, { "trust": 1.7, "url": "http://jvndb.jvn.jp/jvndb/jvndb-2014-000045" }, { "trust": 1.7, "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1091939" }, { "trust": 1.7, "url": "https://cwiki.apache.org/confluence/display/ww/s2-021" }, { "trust": 1.7, "url": "http://secunia.com/advisories/59500" }, { "trust": 1.7, "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html" }, { "trust": 1.7, "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676706" }, { "trust": 1.7, "url": "http://secunia.com/advisories/59178" }, { "trust": 1.7, "url": "http://www.securityfocus.com/archive/1/532549/100/0/threaded" }, { "trust": 1.7, "url": "http://www.securityfocus.com/archive/1/531952/100/0/threaded" }, { "trust": 0.9, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0094" }, { "trust": 0.9, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0112" }, { "trust": 0.8, "url": "http://www.ipa.go.jp/security/ciadr/vul/20140417-struts.html" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0094" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0112" }, { "trust": 0.8, "url": "http://www.konakart.com/downloads/ver-7-3-0-0-whats-new/" }, { "trust": 0.8, "url": "http://www.kb.cert.org/vuls/id/719225" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/152687/red-hat-security-advisory-2019-0910-01.html" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/80006" }, { "trust": 0.3, "url": "http://struts.apache.org/" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2014-0112" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0112" }, { "trust": 0.1, "url": "https://cwe.mitre.org/data/definitions/264.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov" }, { "trust": 0.1, "url": "https://threatpost.com/vmware-patches-apache-struts-flaws-in-vcops/106858/" }, { "trust": 0.1, "url": "https://www.exploit-db.com/exploits/33142/" }, { "trust": 0.1, "url": "http://tools.cisco.com/security/center/viewalert.x?alertid=38390" }, { "trust": 0.1, "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2017-7657" }, { "trust": 0.1, "url": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/html-single/release_notes/" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2017-7525" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2017-7525" }, { "trust": 0.1, "url": "https://bugzilla.redhat.com/):" }, { "trust": 0.1, "url": "https://access.redhat.com/security/updates/classification/#important" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2017-7657" }, { "trust": 0.1, "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=jboss.fuse\u0026version=7.3.0" }, { "trust": 0.1, "url": "https://access.redhat.com/security/team/contact/" }, { "trust": 0.1, "url": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0050" }, { "trust": 0.1, "url": "https://twitter.com/vmwaresrc" }, { "trust": 0.1, "url": "https://www.vmware.com/support/policies/lifecycle.html" }, { "trust": 0.1, "url": "http://kb.vmware.com/kb/2081470" }, { "trust": 0.1, "url": "http://kb.vmware.com/kb/1055" }, { "trust": 0.1, "url": "http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce" }, { "trust": 0.1, "url": "https://www.vmware.com/support/policies/security_response.html" }, { "trust": 0.1, "url": "http://www.vmware.com/security/advisories" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0050" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0094" }, { "trust": 0.1, "url": "https://www.vmware.com/go/download-vcops" } ], "sources": [ { "db": "VULMON", "id": "CVE-2014-0112" }, { "db": "BID", "id": "67064" }, { "db": "JVNDB", "id": "JVNDB-2014-000045" }, { "db": "PACKETSTORM", "id": "152687" }, { "db": "PACKETSTORM", "id": "127215" }, { "db": "CNNVD", "id": "CNNVD-201404-445" }, { "db": "NVD", "id": "CVE-2014-0112" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULMON", "id": "CVE-2014-0112" }, { "db": "BID", "id": "67064" }, { "db": "JVNDB", "id": "JVNDB-2014-000045" }, { "db": "PACKETSTORM", "id": "152687" }, { "db": "PACKETSTORM", "id": "127215" }, { "db": "CNNVD", "id": "CNNVD-201404-445" }, { "db": "NVD", "id": "CVE-2014-0112" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2014-04-29T00:00:00", "db": "VULMON", "id": "CVE-2014-0112" }, { "date": "2014-04-24T00:00:00", "db": "BID", "id": "67064" }, { "date": "2014-04-25T00:00:00", "db": "JVNDB", "id": "JVNDB-2014-000045" }, { "date": "2019-04-30T16:20:15", "db": "PACKETSTORM", "id": "152687" }, { "date": "2014-06-25T21:34:12", "db": "PACKETSTORM", "id": "127215" }, { "date": "2014-04-24T00:00:00", "db": "CNNVD", "id": "CNNVD-201404-445" }, { "date": "2014-04-29T10:37:03.670000", "db": "NVD", "id": "CVE-2014-0112" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-08-12T00:00:00", "db": "VULMON", "id": "CVE-2014-0112" }, { "date": "2015-04-16T18:14:00", "db": "BID", "id": "67064" }, { "date": "2015-05-08T00:00:00", "db": "JVNDB", "id": "JVNDB-2014-000045" }, { "date": "2019-08-14T00:00:00", "db": "CNNVD", "id": "CNNVD-201404-445" }, { "date": "2019-08-12T21:15:12.360000", "db": "NVD", "id": "CVE-2014-0112" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201404-445" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Apache Struts vulnerable to ClassLoader manipulation", "sources": [ { "db": "JVNDB", "id": "JVNDB-2014-000045" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "permissions and access control issues", "sources": [ { "db": "CNNVD", "id": "CNNVD-201404-445" } ], "trust": 0.6 } }
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.