{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.4.3"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.codehaus.groovy:groovy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0"
            },
            {
              "fixed": "2.4.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.4.3"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.codehaus.groovy:groovy-all"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0"
            },
            {
              "fixed": "2.4.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2015-3253"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-06T20:16:53Z",
    "nvd_published_at": "2015-08-13T14:59:00Z",
    "severity": "CRITICAL"
  },
  "details": "The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.",
  "id": "GHSA-qg25-hgjv-cg9q",
  "modified": "2024-10-17T16:17:24Z",
  "published": "2022-05-13T01:25:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2016:1376"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:2486"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:2596"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/groovy"
    },
    {
      "type": "WEB",
      "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed@%3Cnotifications.shardingsphere.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201610-01"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20160623-0001"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
    },
    {
      "type": "WEB",
      "url": "http://groovy-lang.org/security.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-0066.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
    },
    {
      "type": "WEB",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-15-365"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Fuse 6.2.1, which fixes three security issues, several bugs,\nand adds various enhancements, is now available from the Red Hat Customer\nPortal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint,\nflexible, open source enterprise service bus and integration platform.\n\nRed Hat JBoss Fuse 6.2.1 is a micro product release that updates Red Hat\nJBoss Fuse 6.2.0, and includes several bug fixes and enhancements. Refer to\nthe Release Notes document, available from the link in the References\nsection, for a list of changes.\n\nThe following security fixes are addressed in this release:\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this issue may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nA flaw was discovered that when an application uses Groovy (has it on the\nclasspath) and uses the standard Java serialization mechanism, an attacker\ncan bake a special serialized object that executes code directly when\ndeserialized. All applications which rely on serialization and do not\nisolate the code which deserializes objects are subject to this\nvulnerability. (CVE-2015-3253)\n\nIt was found that the JBoss A-MQ console would accept a string containing\nJavaScript as the name of a new message queue. Execution of the UI would\nsubsequently execute the script. An attacker could use this flaw to access\nsensitive information or perform other attacks. (CVE-2015-5181)\n\nRed Hat would like to thank Naftali Rosenbaum of Comsec Consulting for\nreporting CVE-2015-5181.\n\nAll users of Red Hat JBoss Fuse 6.2.0 are advised to apply this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2556",
        "url": "https://access.redhat.com/errata/RHSA-2015:2556"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=distributions\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=distributions\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_Fuse/",
        "url": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_Fuse/"
      },
      {
        "category": "external",
        "summary": "1243934",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
      },
      {
        "category": "external",
        "summary": "1248804",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1248804"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "external",
        "summary": "ENTESB-4398",
        "url": "https://issues.redhat.com/browse/ENTESB-4398"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2556.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Fuse 6.2.1 update",
    "tracking": {
      "current_release_date": "2024-11-05T19:07:25+00:00",
      "generator": {
        "date": "2024-11-05T19:07:25+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2015:2556",
      "initial_release_date": "2015-12-07T20:46:59+00:00",
      "revision_history": [
        {
          "date": "2015-12-07T20:46:59+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:36:05+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T19:07:25+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse 6.2",
                "product": {
                  "name": "Red Hat JBoss Fuse 6.2",
                  "product_id": "Red Hat JBoss Fuse 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-3253",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-07-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1243934"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "groovy: remote execution of untrusted code in class MethodClosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "RHBZ#1243934",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-3253",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/oss-sec/2015/q3/121",
          "url": "http://seclists.org/oss-sec/2015/q3/121"
        }
      ],
      "release_date": "2015-07-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:59+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2556"
        },
        {
          "category": "workaround",
          "details": "Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java):\n\n    public class MethodClosure extends Closure {\n        +    private Object readResolve() {\n        +        throw new UnsupportedOperationException();\n        +    \n        }\n\nAlternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.",
          "product_ids": [
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "groovy: remote execution of untrusted code in class MethodClosure"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Naftali Rosenbaum"
          ],
          "organization": "Comsec Consulting"
        }
      ],
      "cve": "CVE-2015-5181",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2015-04-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1248804"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the JBoss A-MQ console would accept a string containing JavaScript as the name of a new message queue. Execution of the UI would subsequently execute the script. An attacker could use this flaw to access sensitive information or perform other attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Console: script injection into queue name",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-5181"
        },
        {
          "category": "external",
          "summary": "RHBZ#1248804",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1248804"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-5181",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-5181"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5181",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5181"
        }
      ],
      "release_date": "2015-10-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:59+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2556"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Console: script injection into queue name"
    },
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:59+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2556"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Fuse Service Works 6.2.1, which fixes three security issues\nand various bugs, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Fuse Service Works is the next-generation ESB and business\nprocess automation infrastructure.\n\nThis release of Red Hat JBoss Fuse Service Works 6.2.1 serves as a\nreplacement for Red Hat JBoss Fuse Service Works 6.0.0. It includes various\nbug fixes, which are listed in the README file included with the patch\nfiles.\n\nThe following security issues are fixed with this release:\n\nA flaw was discovered that when an application uses Groovy (has it on the\nclasspath) and uses the standard Java serialization mechanism, an attacker\ncan bake a special serialized object that executes code directly when\ndeserialized. All applications which rely on serialization and do not\nisolate the code which deserializes objects are subject to this\nvulnerability. (CVE-2015-3253)\n\nIt was found that Apache Camel\u0027s XML converter performed XML External\nEntity (XXE) expansion. A remote attacker able to submit an SAXSource\ncontaining an XXE declaration could use this flaw to read files accessible\nto the user running the application server, and potentially perform other\nmore advanced XXE attacks. (CVE-2015-0263)\n\nIt was found that Apache Camel performed XML External Entity (XXE)\nexpansion when evaluating invalid XML Strings or invalid XML GenericFile\nobjects. A remote attacker able to submit a crafted XML message could use\nthis flaw to read files accessible to the user running the application\nserver, and potentially perform other more advanced XXE attacks.\n(CVE-2015-0264)\n\nAll users of Red Hat JBoss Fuse Service Works 6.0.0 as provided from the\nRed Hat Customer Portal are advised to apply this security update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2558",
        "url": "https://access.redhat.com/errata/RHSA-2015:2558"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse.serviceworks\u0026downloadType=distributions\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse.serviceworks\u0026downloadType=distributions\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "1203341",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203341"
      },
      {
        "category": "external",
        "summary": "1203344",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203344"
      },
      {
        "category": "external",
        "summary": "1243934",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2558.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Fuse Service Works 6.2.1 update",
    "tracking": {
      "current_release_date": "2024-11-05T19:09:05+00:00",
      "generator": {
        "date": "2024-11-05T19:09:05+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2015:2558",
      "initial_release_date": "2015-12-07T20:46:48+00:00",
      "revision_history": [
        {
          "date": "2015-12-07T20:46:48+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:38:27+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T19:09:05+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse Service Works 6.2",
                "product": {
                  "name": "Red Hat JBoss Fuse Service Works 6.2",
                  "product_id": "Red Hat JBoss Fuse Service Works 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse_service_works:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse Service Works"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-0263",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2015-03-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1203344"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that Apache Camel\u0027s XML converter performed XML External Entity (XXE) expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Camel: XXE in via SAXSource expansion",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse Service Works 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-0263"
        },
        {
          "category": "external",
          "summary": "RHBZ#1203344",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203344"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-0263",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-0263"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0263",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0263"
        },
        {
          "category": "external",
          "summary": "https://camel.apache.org/security-advisories.data/CVE-2015-0263.txt.asc",
          "url": "https://camel.apache.org/security-advisories.data/CVE-2015-0263.txt.asc"
        }
      ],
      "release_date": "2015-03-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:48+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the updates). Before applying the updates, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss Fuse Service Works 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2558"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse Service Works 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Camel: XXE in via SAXSource expansion"
    },
    {
      "cve": "CVE-2015-0264",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2015-03-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1203341"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that Apache Camel performed XML External Entity (XXE) expansion when evaluating invalid XML Strings or invalid XML GenericFile objects. A remote attacker able to submit a crafted XML message could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Camel: XXE via XPath expression evaluation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse Service Works 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-0264"
        },
        {
          "category": "external",
          "summary": "RHBZ#1203341",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203341"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-0264",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-0264"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0264",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0264"
        },
        {
          "category": "external",
          "summary": "https://camel.apache.org/security-advisories.data/CVE-2015-0264.txt.asc",
          "url": "https://camel.apache.org/security-advisories.data/CVE-2015-0264.txt.asc"
        }
      ],
      "release_date": "2015-03-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:48+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the updates). Before applying the updates, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss Fuse Service Works 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2558"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse Service Works 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Camel: XXE via XPath expression evaluation"
    },
    {
      "cve": "CVE-2015-3253",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-07-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1243934"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "groovy: remote execution of untrusted code in class MethodClosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse Service Works 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "RHBZ#1243934",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-3253",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/oss-sec/2015/q3/121",
          "url": "http://seclists.org/oss-sec/2015/q3/121"
        }
      ],
      "release_date": "2015-07-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:48+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the updates). Before applying the updates, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss Fuse Service Works 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2558"
        },
        {
          "category": "workaround",
          "details": "Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java):\n\n    public class MethodClosure extends Closure {\n        +    private Object readResolve() {\n        +        throw new UnsupportedOperationException();\n        +    \n        }\n\nAlternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.",
          "product_ids": [
            "Red Hat JBoss Fuse Service Works 6.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Fuse Service Works 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "groovy: remote execution of untrusted code in class MethodClosure"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Operations Network 3.3 update 5, which fixes two security\nissues and several bugs, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Operations Network is a Middleware management solution that\nprovides a single point of control to deploy, manage, and monitor JBoss\nEnterprise Middleware, applications, and services.\n\nThis JBoss Operations Network 3.3.5 release serves as a replacement for\nJBoss Operations Network 3.3.4, and includes several bug fixes. Refer to\nthe Customer Portal page linked in the References section for information\non the most significant of these changes.\n\nThe following security issues are also fixed with this release:\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the commons-\ncollections library. (CVE-2015-7501)\n\nA flaw was discovered in the way applications using Groovy used the\nstandard Java serialization mechanism. A remote attacker could use a\nspecially crafted serialized object that would execute code directly\nwhen deserialized. All applications which rely on serialization and do\nnot isolate the code which deserializes objects are subject to this\nvulnerability. (CVE-2015-3253)\n\nAll users of JBoss Operations Network 3.3.4 as provided from the Red Hat\nCustomer Portal are advised to upgrade to JBoss Operations Network 3.3.5.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:0118",
        "url": "https://access.redhat.com/errata/RHSA-2016:0118"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em\u0026downloadType=securityPatches\u0026version=3.3",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em\u0026downloadType=securityPatches\u0026version=3.3"
      },
      {
        "category": "external",
        "summary": "1158947",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1158947"
      },
      {
        "category": "external",
        "summary": "1187680",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1187680"
      },
      {
        "category": "external",
        "summary": "1203799",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203799"
      },
      {
        "category": "external",
        "summary": "1206084",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1206084"
      },
      {
        "category": "external",
        "summary": "1231199",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1231199"
      },
      {
        "category": "external",
        "summary": "1234991",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1234991"
      },
      {
        "category": "external",
        "summary": "1243934",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
      },
      {
        "category": "external",
        "summary": "1255196",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1255196"
      },
      {
        "category": "external",
        "summary": "1261907",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1261907"
      },
      {
        "category": "external",
        "summary": "1269420",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1269420"
      },
      {
        "category": "external",
        "summary": "1277389",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1277389"
      },
      {
        "category": "external",
        "summary": "1278215",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1278215"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "external",
        "summary": "1293350",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1293350"
      },
      {
        "category": "external",
        "summary": "1293368",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1293368"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0118.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Operations Network 3.3.5 update",
    "tracking": {
      "current_release_date": "2024-11-05T19:12:13+00:00",
      "generator": {
        "date": "2024-11-05T19:12:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2016:0118",
      "initial_release_date": "2016-02-03T15:00:55+00:00",
      "revision_history": [
        {
          "date": "2016-02-03T15:00:55+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:37:30+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T19:12:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Operations Network 3.3",
                "product": {
                  "name": "Red Hat JBoss Operations Network 3.3",
                  "product_id": "Red Hat JBoss Operations Network 3.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_operations_network:3.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Operations Network"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-3253",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-07-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1243934"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "groovy: remote execution of untrusted code in class MethodClosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "RHBZ#1243934",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-3253",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/oss-sec/2015/q3/121",
          "url": "http://seclists.org/oss-sec/2015/q3/121"
        }
      ],
      "release_date": "2015-07-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-02-03T15:00:55+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.5 Release Notes for\ninstallation information.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:0118"
        },
        {
          "category": "workaround",
          "details": "Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java):\n\n    public class MethodClosure extends Closure {\n        +    private Object readResolve() {\n        +        throw new UnsupportedOperationException();\n        +    \n        }\n\nAlternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "groovy: remote execution of untrusted code in class MethodClosure"
    },
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-02-03T15:00:55+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.5 Release Notes for\ninstallation information.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:0118"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for rh-maven33-groovy is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Groovy is an agile and dynamic language for the Java Virtual Machine, built upon Java with features inspired by languages like Python, Ruby, and Smalltalk. It seamlessly integrates with all existing Java objects and libraries and compiles straight to Java bytecode so you can use it anywhere you can use Java.\n\nSecurity Fix(es):\n\n* Multiple object deserialization flaws were discovered in the MethodClosure class in Groovy. A specially crafted serialized object deserialized by an application using the Groovy library could cause the application to execute arbitrary code. (CVE-2015-3253, CVE-2016-6814)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2017:2596",
        "url": "https://access.redhat.com/errata/RHSA-2017:2596"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1243934",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
      },
      {
        "category": "external",
        "summary": "1413466",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1413466"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2596.json"
      }
    ],
    "title": "Red Hat Security Advisory: rh-maven33-groovy security update",
    "tracking": {
      "current_release_date": "2024-11-05T20:10:43+00:00",
      "generator": {
        "date": "2024-11-05T20:10:43+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2017:2596",
      "initial_release_date": "2017-09-05T22:54:05+00:00",
      "revision_history": [
        {
          "date": "2017-09-05T22:54:05+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2017-09-05T22:54:05+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T20:10:43+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                  "product_id": "6Server-RHSCL-2.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                  "product_id": "6Workstation-RHSCL-2.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
                  "product_id": "6Server-RHSCL-2.4-6.7.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                  "product_id": "7Server-RHSCL-2.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                  "product_id": "7Workstation-RHSCL-2.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
                  "product_id": "7Server-RHSCL-2.4-7.3.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Software Collections"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-maven33-groovy-0:1.8.9-7.19.el6.src",
                "product": {
                  "name": "rh-maven33-groovy-0:1.8.9-7.19.el6.src",
                  "product_id": "rh-maven33-groovy-0:1.8.9-7.19.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-maven33-groovy@1.8.9-7.19.el6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-maven33-groovy-0:1.8.9-7.19.el7.src",
                "product": {
                  "name": "rh-maven33-groovy-0:1.8.9-7.19.el7.src",
                  "product_id": "rh-maven33-groovy-0:1.8.9-7.19.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-maven33-groovy@1.8.9-7.19.el7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
                "product": {
                  "name": "rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
                  "product_id": "rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-maven33-groovy@1.8.9-7.19.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
                "product": {
                  "name": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
                  "product_id": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-maven33-groovy-javadoc@1.8.9-7.19.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
                "product": {
                  "name": "rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
                  "product_id": "rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-maven33-groovy@1.8.9-7.19.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
                "product": {
                  "name": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
                  "product_id": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-maven33-groovy-javadoc@1.8.9-7.19.el7?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-0:1.8.9-7.19.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
          "product_id": "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch"
        },
        "product_reference": "rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-2.4-6.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-0:1.8.9-7.19.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
          "product_id": "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.src"
        },
        "product_reference": "rh-maven33-groovy-0:1.8.9-7.19.el6.src",
        "relates_to_product_reference": "6Server-RHSCL-2.4-6.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
          "product_id": "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch"
        },
        "product_reference": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-2.4-6.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-0:1.8.9-7.19.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch"
        },
        "product_reference": "rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-0:1.8.9-7.19.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src"
        },
        "product_reference": "rh-maven33-groovy-0:1.8.9-7.19.el6.src",
        "relates_to_product_reference": "6Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch"
        },
        "product_reference": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-0:1.8.9-7.19.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch"
        },
        "product_reference": "rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-0:1.8.9-7.19.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src"
        },
        "product_reference": "rh-maven33-groovy-0:1.8.9-7.19.el6.src",
        "relates_to_product_reference": "6Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch"
        },
        "product_reference": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-0:1.8.9-7.19.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
          "product_id": "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch"
        },
        "product_reference": "rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-2.4-7.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-0:1.8.9-7.19.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
          "product_id": "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.src"
        },
        "product_reference": "rh-maven33-groovy-0:1.8.9-7.19.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-2.4-7.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
          "product_id": "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch"
        },
        "product_reference": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-2.4-7.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-0:1.8.9-7.19.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch"
        },
        "product_reference": "rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-0:1.8.9-7.19.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src"
        },
        "product_reference": "rh-maven33-groovy-0:1.8.9-7.19.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch"
        },
        "product_reference": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-0:1.8.9-7.19.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch"
        },
        "product_reference": "rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-0:1.8.9-7.19.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src"
        },
        "product_reference": "rh-maven33-groovy-0:1.8.9-7.19.el7.src",
        "relates_to_product_reference": "7Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch"
        },
        "product_reference": "rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-2.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-3253",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-07-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1243934"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "groovy: remote execution of untrusted code in class MethodClosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
          "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
          "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
          "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
          "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
          "6Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
          "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
          "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
          "6Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
          "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
          "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
          "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
          "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
          "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
          "7Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
          "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
          "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
          "7Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "RHBZ#1243934",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-3253",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/oss-sec/2015/q3/121",
          "url": "http://seclists.org/oss-sec/2015/q3/121"
        }
      ],
      "release_date": "2015-07-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-09-05T22:54:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
            "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
            "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
            "6Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
            "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
            "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
            "6Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
            "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
            "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
            "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
            "7Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
            "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
            "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
            "7Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:2596"
        },
        {
          "category": "workaround",
          "details": "Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java):\n\n    public class MethodClosure extends Closure {\n        +    private Object readResolve() {\n        +        throw new UnsupportedOperationException();\n        +    \n        }\n\nAlternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.",
          "product_ids": [
            "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
            "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
            "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
            "6Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
            "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
            "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
            "6Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
            "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
            "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
            "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
            "7Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
            "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
            "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
            "7Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
            "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
            "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
            "6Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
            "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
            "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
            "6Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
            "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
            "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
            "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
            "7Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
            "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
            "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
            "7Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "groovy: remote execution of untrusted code in class MethodClosure"
    },
    {
      "cve": "CVE-2016-6814",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2017-01-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1413466"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Groovy: Remote code execution via deserialization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the versions of groovy as shipped with Red Hat Satellite 6.0 and 6.1. Red Hat Satellite 6.2 and later do not ship groovy, as such they are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
          "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
          "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
          "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
          "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
          "6Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
          "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
          "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
          "6Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
          "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
          "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
          "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
          "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
          "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
          "7Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
          "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
          "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
          "7Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-6814"
        },
        {
          "category": "external",
          "summary": "RHBZ#1413466",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1413466"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-6814",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-6814"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6814",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6814"
        }
      ],
      "release_date": "2017-01-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-09-05T22:54:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
            "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
            "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
            "6Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
            "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
            "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
            "6Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
            "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
            "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
            "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
            "7Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
            "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
            "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
            "7Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:2596"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
            "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
            "6Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
            "6Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
            "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.noarch",
            "6Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el6.src",
            "6Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch",
            "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
            "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
            "7Server-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
            "7Server-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch",
            "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.noarch",
            "7Workstation-RHSCL-2.4:rh-maven33-groovy-0:1.8.9-7.19.el7.src",
            "7Workstation-RHSCL-2.4:rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Groovy: Remote code execution via deserialization"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for groovy is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Groovy is an agile and dynamic language for the Java Virtual Machine, built upon Java with features inspired by languages like Python, Ruby, and Smalltalk. It seamlessly integrates with all existing Java objects and libraries and compiles straight to Java bytecode so you can use it anywhere you can use Java.\n\nSecurity Fix(es):\n\n* It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability. (CVE-2016-6814)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2017:2486",
        "url": "https://access.redhat.com/errata/RHSA-2017:2486"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1413466",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1413466"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2486.json"
      }
    ],
    "title": "Red Hat Security Advisory: groovy security update",
    "tracking": {
      "current_release_date": "2024-11-05T20:10:04+00:00",
      "generator": {
        "date": "2024-11-05T20:10:04+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2017:2486",
      "initial_release_date": "2017-08-17T02:38:21+00:00",
      "revision_history": [
        {
          "date": "2017-08-17T02:38:21+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2017-08-17T02:38:21+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T20:10:04+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Client Optional (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Client Optional (v. 7)",
                  "product_id": "7Client-optional-7.4.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
                  "product_id": "7ComputeNode-optional-7.4.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::computenode"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server Optional (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server Optional (v. 7)",
                  "product_id": "7Server-optional-7.4.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)",
                  "product_id": "7Workstation-optional-7.4.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "groovy-0:1.8.9-8.el7_4.src",
                "product": {
                  "name": "groovy-0:1.8.9-8.el7_4.src",
                  "product_id": "groovy-0:1.8.9-8.el7_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/groovy@1.8.9-8.el7_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "groovy-0:1.8.9-8.el7_4.noarch",
                "product": {
                  "name": "groovy-0:1.8.9-8.el7_4.noarch",
                  "product_id": "groovy-0:1.8.9-8.el7_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/groovy@1.8.9-8.el7_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "groovy-javadoc-0:1.8.9-8.el7_4.noarch",
                "product": {
                  "name": "groovy-javadoc-0:1.8.9-8.el7_4.noarch",
                  "product_id": "groovy-javadoc-0:1.8.9-8.el7_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/groovy-javadoc@1.8.9-8.el7_4?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "groovy-0:1.8.9-8.el7_4.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch"
        },
        "product_reference": "groovy-0:1.8.9-8.el7_4.noarch",
        "relates_to_product_reference": "7Client-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "groovy-0:1.8.9-8.el7_4.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src"
        },
        "product_reference": "groovy-0:1.8.9-8.el7_4.src",
        "relates_to_product_reference": "7Client-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "groovy-javadoc-0:1.8.9-8.el7_4.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch"
        },
        "product_reference": "groovy-javadoc-0:1.8.9-8.el7_4.noarch",
        "relates_to_product_reference": "7Client-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "groovy-0:1.8.9-8.el7_4.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
          "product_id": "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch"
        },
        "product_reference": "groovy-0:1.8.9-8.el7_4.noarch",
        "relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "groovy-0:1.8.9-8.el7_4.src as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
          "product_id": "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src"
        },
        "product_reference": "groovy-0:1.8.9-8.el7_4.src",
        "relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "groovy-javadoc-0:1.8.9-8.el7_4.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
          "product_id": "7ComputeNode-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch"
        },
        "product_reference": "groovy-javadoc-0:1.8.9-8.el7_4.noarch",
        "relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "groovy-0:1.8.9-8.el7_4.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
          "product_id": "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch"
        },
        "product_reference": "groovy-0:1.8.9-8.el7_4.noarch",
        "relates_to_product_reference": "7Server-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "groovy-0:1.8.9-8.el7_4.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
          "product_id": "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src"
        },
        "product_reference": "groovy-0:1.8.9-8.el7_4.src",
        "relates_to_product_reference": "7Server-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "groovy-javadoc-0:1.8.9-8.el7_4.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
          "product_id": "7Server-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch"
        },
        "product_reference": "groovy-javadoc-0:1.8.9-8.el7_4.noarch",
        "relates_to_product_reference": "7Server-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "groovy-0:1.8.9-8.el7_4.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
          "product_id": "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch"
        },
        "product_reference": "groovy-0:1.8.9-8.el7_4.noarch",
        "relates_to_product_reference": "7Workstation-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "groovy-0:1.8.9-8.el7_4.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
          "product_id": "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src"
        },
        "product_reference": "groovy-0:1.8.9-8.el7_4.src",
        "relates_to_product_reference": "7Workstation-optional-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "groovy-javadoc-0:1.8.9-8.el7_4.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
          "product_id": "7Workstation-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch"
        },
        "product_reference": "groovy-javadoc-0:1.8.9-8.el7_4.noarch",
        "relates_to_product_reference": "7Workstation-optional-7.4.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-3253",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-07-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1243934"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "groovy: remote execution of untrusted code in class MethodClosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
          "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
          "7Client-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
          "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
          "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
          "7ComputeNode-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
          "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
          "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
          "7Server-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
          "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
          "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
          "7Workstation-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "RHBZ#1243934",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-3253",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/oss-sec/2015/q3/121",
          "url": "http://seclists.org/oss-sec/2015/q3/121"
        }
      ],
      "release_date": "2015-07-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-08-17T02:38:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7Client-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
            "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7ComputeNode-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
            "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7Server-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
            "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7Workstation-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:2486"
        },
        {
          "category": "workaround",
          "details": "Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java):\n\n    public class MethodClosure extends Closure {\n        +    private Object readResolve() {\n        +        throw new UnsupportedOperationException();\n        +    \n        }\n\nAlternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.",
          "product_ids": [
            "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7Client-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
            "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7ComputeNode-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
            "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7Server-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
            "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7Workstation-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7Client-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
            "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7ComputeNode-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
            "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7Server-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
            "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7Workstation-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "groovy: remote execution of untrusted code in class MethodClosure"
    },
    {
      "cve": "CVE-2016-6814",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2017-01-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1413466"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Groovy: Remote code execution via deserialization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the versions of groovy as shipped with Red Hat Satellite 6.0 and 6.1. Red Hat Satellite 6.2 and later do not ship groovy, as such they are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
          "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
          "7Client-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
          "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
          "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
          "7ComputeNode-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
          "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
          "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
          "7Server-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
          "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
          "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
          "7Workstation-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-6814"
        },
        {
          "category": "external",
          "summary": "RHBZ#1413466",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1413466"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-6814",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-6814"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6814",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6814"
        }
      ],
      "release_date": "2017-01-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-08-17T02:38:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7Client-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
            "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7ComputeNode-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
            "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7Server-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
            "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7Workstation-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:2486"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7Client-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7Client-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
            "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7ComputeNode-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7ComputeNode-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
            "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7Server-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7Server-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch",
            "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.noarch",
            "7Workstation-optional-7.4.Z:groovy-0:1.8.9-8.el7_4.src",
            "7Workstation-optional-7.4.Z:groovy-javadoc-0:1.8.9-8.el7_4.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Groovy: Remote code execution via deserialization"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Data Virtualization 6.2.0 update 2, which fixes one security\nissue and various bugs, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Data Virtualization is a lean data integration solution that\nprovides easy, real-time, and unified data access across disparate sources\nto multiple applications and users. JBoss Data Virtualization makes data\nspread across physically distinct systems\u2014such as multiple databases, XML\nfiles, and even Hadoop systems\u2014appear as a set of tables in a local\ndatabase.\n\nThis update serves as a cumulative upgrade for Red Hat JBoss Data\nVirtualization 6.2.0. It includes various bug fixes, which are listed in\nthe README file included with the patch files.\n\nThe following security issue is also fixed with this release:\n\nA flaw was discovered in the way applications using Groovy used the\nstandard Java serialization mechanism. A remote attacker could use a\nspecially crafted serialized object that would execute code directly when\ndeserialized. All applications which rely on serialization and do not\nisolate the code which deserializes objects are subject to this\nvulnerability. (CVE-2015-3253)\n\nAll users of Red Hat JBoss Data Virtualization 6.2.0 as provided from the\nRed Hat Customer Portal are advised to apply this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:0066",
        "url": "https://access.redhat.com/errata/RHSA-2016:0066"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=6.2.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=6.2.0"
      },
      {
        "category": "external",
        "summary": "1243934",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0066.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.2.0 security update",
    "tracking": {
      "current_release_date": "2024-11-05T19:11:29+00:00",
      "generator": {
        "date": "2024-11-05T19:11:29+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2016:0066",
      "initial_release_date": "2016-01-25T22:10:54+00:00",
      "revision_history": [
        {
          "date": "2016-01-25T22:10:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:37:51+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T19:11:29+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Data Virtualization 6.2",
                "product": {
                  "name": "Red Hat JBoss Data Virtualization 6.2",
                  "product_id": "Red Hat JBoss Data Virtualization 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_data_virtualization:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Data Virtualization"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-3253",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-07-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1243934"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "groovy: remote execution of untrusted code in class MethodClosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Data Virtualization 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "RHBZ#1243934",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-3253",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/oss-sec/2015/q3/121",
          "url": "http://seclists.org/oss-sec/2015/q3/121"
        }
      ],
      "release_date": "2015-07-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-01-25T22:10:54+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:0066"
        },
        {
          "category": "workaround",
          "details": "Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java):\n\n    public class MethodClosure extends Closure {\n        +    private Object readResolve() {\n        +        throw new UnsupportedOperationException();\n        +    \n        }\n\nAlternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Data Virtualization 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "groovy: remote execution of untrusted code in class MethodClosure"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat JBoss SOA Platform 5.3.1.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss SOA Platform is the next-generation ESB and business process\nautomation infrastructure. Red Hat JBoss SOA Platform allows IT to leverage\nexisting (MoM and EAI), modern (SOA and BPM-Rules), and future (EDA and\nCEP) integration methodologies to dramatically improve business process\nexecution speed and quality.\n\nSecurity Fix(es):\n\n* It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141)\n\n* It was found that a prior countermeasure in Apache WSS4J for Bleichenbacher\u0027s attack on XML Encryption (CVE-2011-2487) threw an exception that permitted an attacker to determine the failure of the attempted attack, thereby leaving WSS4J vulnerable to the attack. The original flaw allowed a remote attacker to recover the entire plain text form of a symmetric key. (CVE-2015-0226)\n\n* It was found that the Java Standard Tag Library (JSTL) allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution. (CVE-2015-0254)\n\n* A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability. (CVE-2015-3253)\n\n* A deserialization flaw allowing remote code execution was found in the BeanShell library. If BeanShell was on the classpath, it could permit code execution if another part of the application deserialized objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the BeanShell library. (CVE-2016-2510)\n\nThe CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat).",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:1376",
        "url": "https://access.redhat.com/errata/RHSA-2016:1376"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform\u0026downloadType=securityPatches\u0026version=5.3.1+GA",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform\u0026downloadType=securityPatches\u0026version=5.3.1+GA"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/2360521",
        "url": "https://access.redhat.com/articles/2360521"
      },
      {
        "category": "external",
        "summary": "1191446",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1191446"
      },
      {
        "category": "external",
        "summary": "1198606",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1198606"
      },
      {
        "category": "external",
        "summary": "1243934",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
      },
      {
        "category": "external",
        "summary": "1310647",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1310647"
      },
      {
        "category": "external",
        "summary": "1313589",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313589"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1376.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss SOA Platform security update",
    "tracking": {
      "current_release_date": "2024-11-05T19:22:57+00:00",
      "generator": {
        "date": "2024-11-05T19:22:57+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2016:1376",
      "initial_release_date": "2016-06-30T21:06:13+00:00",
      "revision_history": [
        {
          "date": "2016-06-30T21:06:13+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:39:09+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T19:22:57+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss SOA Platform 5.3",
                "product": {
                  "name": "Red Hat JBoss SOA Platform 5.3",
                  "product_id": "Red Hat JBoss SOA Platform 5.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_soa_platform:5.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss SOA Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-0226",
      "cwe": {
        "id": "CWE-327",
        "name": "Use of a Broken or Risky Cryptographic Algorithm"
      },
      "discovery_date": "2015-02-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1191446"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that a prior countermeasure in Apache WSS4J for Bleichenbacher\u0027s attack on XML Encryption (CVE-2011-2487) threw an exception that permitted an attacker to determine the failure of the attempted attack, thereby leaving WSS4J vulnerable to the attack. The original flaw allowed a remote attacker to recover the entire plain text form of a symmetric key.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wss4j: Apache WSS4J is vulnerable to Bleichenbacher\u0027s attack (incomplete fix for CVE-2011-2487)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss SOA Platform 5.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-0226"
        },
        {
          "category": "external",
          "summary": "RHBZ#1191446",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1191446"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-0226",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-0226"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0226",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0226"
        }
      ],
      "release_date": "2015-02-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-06-30T21:06:13+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss SOA Platform installation (including its databases,\napplications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss SOA Platform server\nby stopping the JBoss Application Server process before installing this\nupdate, and then after installing the update, restart the Red Hat JBoss SOA\nPlatform server by starting the JBoss Application Server process.",
          "product_ids": [
            "Red Hat JBoss SOA Platform 5.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1376"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 7.8,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss SOA Platform 5.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "wss4j: Apache WSS4J is vulnerable to Bleichenbacher\u0027s attack (incomplete fix for CVE-2011-2487)"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Apache Software Foundation"
          ]
        },
        {
          "names": [
            "David Jorm"
          ],
          "organization": "IIX"
        }
      ],
      "cve": "CVE-2015-0254",
      "discovery_date": "2015-03-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1198606"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Java Standard Tag Library (JSTL) allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Users of EAP 6.x and 7.0 should upgrade to at least 6.4.9 and pass the following system property on startup to prevent XXE attacks in JSTL:\norg.apache.taglibs.standard.xml.accessExternalEntity=false\n\nFor more details please see refer to this KCS solution:\nhttps://access.redhat.com/solutions/1584363",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss SOA Platform 5.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-0254"
        },
        {
          "category": "external",
          "summary": "RHBZ#1198606",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1198606"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-0254",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-0254"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0254",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0254"
        }
      ],
      "release_date": "2015-02-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-06-30T21:06:13+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss SOA Platform installation (including its databases,\napplications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss SOA Platform server\nby stopping the JBoss Application Server process before installing this\nupdate, and then after installing the update, restart the Red Hat JBoss SOA\nPlatform server by starting the JBoss Application Server process.",
          "product_ids": [
            "Red Hat JBoss SOA Platform 5.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1376"
        },
        {
          "category": "workaround",
          "details": "Users should upgrade to Apache Standard Taglibs 1.2.3 or later.\n\nThis version uses JAXP\u2019s FEATURE_SECURE_PROCESSING to restrict XML processing. Depending on the Java runtime version in use, additional configuration may be required:\n\nJava8:\nExternal entity access is automatically disabled if a SecurityManager is active.\n\nJava7:\nJAXP properties may need to be used to disable external access. See http://docs.oracle.com/javase/tutorial/jaxp/properties/properties.html\n\nJava6 and earlier:\nA new system property org.apache.taglibs.standard.xml.accessExternalEntity may be used to specify the protocols that can be used to access external entities. This defaults to \"all\" if no SecurityManager is present and to \"\" (thereby disabling access) if a SecurityManager is detected.",
          "product_ids": [
            "Red Hat JBoss SOA Platform 5.3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss SOA Platform 5.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags"
    },
    {
      "cve": "CVE-2015-3253",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-07-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1243934"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "groovy: remote execution of untrusted code in class MethodClosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss SOA Platform 5.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "RHBZ#1243934",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-3253",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/oss-sec/2015/q3/121",
          "url": "http://seclists.org/oss-sec/2015/q3/121"
        }
      ],
      "release_date": "2015-07-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-06-30T21:06:13+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss SOA Platform installation (including its databases,\napplications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss SOA Platform server\nby stopping the JBoss Application Server process before installing this\nupdate, and then after installing the update, restart the Red Hat JBoss SOA\nPlatform server by starting the JBoss Application Server process.",
          "product_ids": [
            "Red Hat JBoss SOA Platform 5.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1376"
        },
        {
          "category": "workaround",
          "details": "Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java):\n\n    public class MethodClosure extends Closure {\n        +    private Object readResolve() {\n        +        throw new UnsupportedOperationException();\n        +    \n        }\n\nAlternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.",
          "product_ids": [
            "Red Hat JBoss SOA Platform 5.3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss SOA Platform 5.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "groovy: remote execution of untrusted code in class MethodClosure"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Dennis Reed"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2016-2141",
      "discovery_date": "2015-11-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1313589"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "JGroups: Authorization bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss SOA Platform 5.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-2141"
        },
        {
          "category": "external",
          "summary": "RHBZ#1313589",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313589"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-2141",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-2141"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2141",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2141"
        }
      ],
      "release_date": "2016-06-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-06-30T21:06:13+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss SOA Platform installation (including its databases,\napplications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss SOA Platform server\nby stopping the JBoss Application Server process before installing this\nupdate, and then after installing the update, restart the Red Hat JBoss SOA\nPlatform server by starting the JBoss Application Server process.",
          "product_ids": [
            "Red Hat JBoss SOA Platform 5.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1376"
        },
        {
          "category": "workaround",
          "details": "Please refer to https://access.redhat.com/articles/2360521 for more information.",
          "product_ids": [
            "Red Hat JBoss SOA Platform 5.3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss SOA Platform 5.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "JGroups: Authorization bypass"
    },
    {
      "cve": "CVE-2016-2510",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2016-02-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1310647"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A deserialization flaw allowing remote code execution was found in the BeanShell library. If BeanShell was on the classpath, it could permit code execution if another part of the application deserialized objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the BeanShell library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bsh2: remote code execution via deserialization",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss SOA Platform 5.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-2510"
        },
        {
          "category": "external",
          "summary": "RHBZ#1310647",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1310647"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-2510",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-2510"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2510",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2510"
        },
        {
          "category": "external",
          "summary": "https://github.com/beanshell/beanshell/releases/tag/2.0b6",
          "url": "https://github.com/beanshell/beanshell/releases/tag/2.0b6"
        }
      ],
      "release_date": "2016-02-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-06-30T21:06:13+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss SOA Platform installation (including its databases,\napplications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss SOA Platform server\nby stopping the JBoss Application Server process before installing this\nupdate, and then after installing the update, restart the Red Hat JBoss SOA\nPlatform server by starting the JBoss Application Server process.",
          "product_ids": [
            "Red Hat JBoss SOA Platform 5.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1376"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss SOA Platform 5.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bsh2: remote code execution via deserialization"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss A-MQ 6.2.1, which fixes three security issues, several bugs,\nand adds various enhancements, is now available from the Red Hat Customer\nPortal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards-compliant\nmessaging system that is tailored for use in mission critical applications.\n\nRed Hat JBoss A-MQ 6.2.1 is a micro product release that updates Red Hat\nJBoss A-MQ 6.2.0, and includes several bug fixes and enhancements. Refer to\nthe Release Notes document, available from the link in the References\nsection, for a list of changes.\n\nThe following security fixes are addressed in this release:\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this issue may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nA flaw was discovered that when an application uses Groovy (has it on the\nclasspath) and uses the standard Java serialization mechanism, an attacker\ncan bake a special serialized object that executes code directly when\ndeserialized. All applications which rely on serialization and do not\nisolate the code which deserializes objects are subject to this\nvulnerability. (CVE-2015-3253)\n\nIt was found that the JBoss A-MQ console would accept a string containing\nJavaScript as the name of a new message queue. Execution of the UI would\nsubsequently execute the script. An attacker could use this flaw to access\nsensitive information or perform other attacks. (CVE-2015-5181)\n\nRed Hat would like to thank Naftali Rosenbaum of Comsec Consulting for\nreporting CVE-2015-5181.\n\nAll users of Red Hat JBoss A-MQ 6.2.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2557",
        "url": "https://access.redhat.com/errata/RHSA-2015:2557"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=distributions\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=distributions\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_A-MQ/",
        "url": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_A-MQ/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1243934",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
      },
      {
        "category": "external",
        "summary": "1248804",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1248804"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "external",
        "summary": "ENTESB-4398",
        "url": "https://issues.redhat.com/browse/ENTESB-4398"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2557.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss A-MQ 6.2.1 update",
    "tracking": {
      "current_release_date": "2024-11-05T19:07:20+00:00",
      "generator": {
        "date": "2024-11-05T19:07:20+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2015:2557",
      "initial_release_date": "2015-12-07T20:46:54+00:00",
      "revision_history": [
        {
          "date": "2015-12-07T20:46:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:36:21+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T19:07:20+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss A-MQ 6.2",
                "product": {
                  "name": "Red Hat JBoss A-MQ 6.2",
                  "product_id": "Red Hat JBoss A-MQ 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_amq:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss AMQ"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-3253",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-07-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1243934"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "groovy: remote execution of untrusted code in class MethodClosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "RHBZ#1243934",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-3253",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/oss-sec/2015/q3/121",
          "url": "http://seclists.org/oss-sec/2015/q3/121"
        }
      ],
      "release_date": "2015-07-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:54+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2557"
        },
        {
          "category": "workaround",
          "details": "Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java):\n\n    public class MethodClosure extends Closure {\n        +    private Object readResolve() {\n        +        throw new UnsupportedOperationException();\n        +    \n        }\n\nAlternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "groovy: remote execution of untrusted code in class MethodClosure"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Naftali Rosenbaum"
          ],
          "organization": "Comsec Consulting"
        }
      ],
      "cve": "CVE-2015-5181",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2015-04-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1248804"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the JBoss A-MQ console would accept a string containing JavaScript as the name of a new message queue. Execution of the UI would subsequently execute the script. An attacker could use this flaw to access sensitive information or perform other attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Console: script injection into queue name",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-5181"
        },
        {
          "category": "external",
          "summary": "RHBZ#1248804",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1248804"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-5181",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-5181"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5181",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5181"
        }
      ],
      "release_date": "2015-10-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:54+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2557"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Console: script injection into queue name"
    },
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:54+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2557"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2015-3253",
    "description": "The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.",
    "id": "GSD-2015-3253",
    "references": [
      "https://access.redhat.com/errata/RHSA-2017:2596",
      "https://access.redhat.com/errata/RHSA-2017:2486",
      "https://access.redhat.com/errata/RHSA-2016:1376",
      "https://access.redhat.com/errata/RHSA-2016:0118",
      "https://access.redhat.com/errata/RHSA-2016:0066",
      "https://access.redhat.com/errata/RHSA-2015:2558",
      "https://access.redhat.com/errata/RHSA-2015:2557",
      "https://access.redhat.com/errata/RHSA-2015:2556",
      "https://advisories.mageia.org/CVE-2015-3253.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2015-3253"
      ],
      "details": "The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.",
      "id": "GSD-2015-3253",
      "modified": "2023-12-13T01:20:07.076693Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2015-3253",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
          },
          {
            "name": "RHSA-2017:2596",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2017:2596"
          },
          {
            "name": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"
          },
          {
            "name": "RHSA-2016:1376",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2016:1376"
          },
          {
            "name": "GLSA-201610-01",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/201610-01"
          },
          {
            "name": "http://groovy-lang.org/security.html",
            "refsource": "CONFIRM",
            "url": "http://groovy-lang.org/security.html"
          },
          {
            "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755",
            "refsource": "CONFIRM",
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"
          },
          {
            "name": "http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20160623-0001/",
            "refsource": "CONFIRM",
            "url": "https://security.netapp.com/advisory/ntap-20160623-0001/"
          },
          {
            "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
          },
          {
            "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
          },
          {
            "name": "RHSA-2016:0066",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0066.html"
          },
          {
            "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"
          },
          {
            "name": "91787",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/91787"
          },
          {
            "name": "http://www.zerodayinitiative.com/advisories/ZDI-15-365/",
            "refsource": "MISC",
            "url": "http://www.zerodayinitiative.com/advisories/ZDI-15-365/"
          },
          {
            "name": "RHSA-2017:2486",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2017:2486"
          },
          {
            "name": "1034815",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id/1034815"
          },
          {
            "name": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
          },
          {
            "name": "75919",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/75919"
          },
          {
            "name": "20150716 [CVE-2015-3253] Apache Groovy Zero-Day Vulnerability Disclosure",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/536012/100/0/threaded"
          },
          {
            "name": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
            "refsource": "MISC",
            "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
          },
          {
            "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
            "refsource": "MISC",
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "name": "[shardingsphere-notifications] 20200623 [GitHub] [shardingsphere] liuqiankun93 opened a new issue #6180: The groovy-2.4.5-indy.jar has High-level security risks",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed@%3Cnotifications.shardingsphere.apache.org%3E"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "[1.7.0,2-alpha0),[2-alpha0,2.4.3]",
          "affected_versions": "All versions starting from 1.7.0 before 2-alpha0, all versions starting from 2-alpha0 up to 2.4.3",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-74",
            "CWE-937"
          ],
          "date": "2019-04-23",
          "description": "The `MethodClosure` class in `runtime/MethodClosure.java` in this package allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.",
          "fixed_versions": [
            "2.4.4"
          ],
          "identifier": "CVE-2015-3253",
          "identifiers": [
            "CVE-2015-3253"
          ],
          "not_impacted": "All versions before 1.7.0, all versions starting from 2-alpha0",
          "package_slug": "maven/org.codehaus.groovy/groovy-all",
          "pubdate": "2015-08-13",
          "solution": "Upgrade to version 2.4.4 or above.",
          "title": "Remote execution of untrusted code in class MethodClosure",
          "urls": [
            "http://seclists.org/oss-sec/2015/q3/121"
          ],
          "uuid": "ff54d1a8-27c6-4831-bbe2-763929120596"
        },
        {
          "affected_range": "[1.7.0,2.4.3]",
          "affected_versions": "All versions starting from 1.7.0 up to 2.4.3",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-74",
            "CWE-78",
            "CWE-937"
          ],
          "date": "2022-07-06",
          "description": "The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.",
          "fixed_versions": [
            "2.4.4"
          ],
          "identifier": "CVE-2015-3253",
          "identifiers": [
            "GHSA-qg25-hgjv-cg9q",
            "CVE-2015-3253"
          ],
          "not_impacted": "All versions before 1.7.0, all versions after 2.4.3",
          "package_slug": "maven/org.codehaus.groovy/groovy",
          "pubdate": "2022-05-13",
          "solution": "Upgrade to version 2.4.4 or above.",
          "title": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2015-3253",
            "https://access.redhat.com/errata/RHSA-2016:1376",
            "https://access.redhat.com/errata/RHSA-2017:2486",
            "https://access.redhat.com/errata/RHSA-2017:2596",
            "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755",
            "https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed@%3Cnotifications.shardingsphere.apache.org%3E",
            "https://security.gentoo.org/glsa/201610-01",
            "https://security.netapp.com/advisory/ntap-20160623-0001/",
            "https://www.oracle.com/security-alerts/cpuapr2020.html",
            "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
            "http://groovy-lang.org/security.html",
            "http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html",
            "http://rhn.redhat.com/errata/RHSA-2016-0066.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html",
            "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
            "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            "http://www.zerodayinitiative.com/advisories/ZDI-15-365/",
            "https://github.com/advisories/GHSA-qg25-hgjv-cg9q"
          ],
          "uuid": "2ed4059b-898c-437b-bf60-666cea934e63"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.0:beta_1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.0:beta_2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.0:beta_1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.0:beta_2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.0:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.0:rc2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.1.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.1.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.2.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.0:beta_1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.4.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.4.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.0:rc3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.0:rc4:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.0:beta_2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.0:beta_3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.1.0:rc2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.1.0:rc3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.1.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.1.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.4.0:rc2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.0:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.0:rc2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.9.0:beta_4:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.0:beta_1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.1.0:beta_1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.1.0:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.1.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.1.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.2.0:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.2.0:rc2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.2.0:rc3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.0:rc2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.0:rc3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.4.0:beta_4:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.4.0:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.0:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.0:rc2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.7.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.0:beta_3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.0:beta_4:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.8.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.9.0:beta_1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:1.9.0:beta_3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.0:rc3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.0:rc4:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.0.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.1.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.2.0:beta_1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.2.0:beta_2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.0:beta_2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.0:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.3.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.4.0:beta_1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.4.0:beta_2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.4.0:beta_3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:groovy:2.4.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:health_sciences_clinical_development_center:3.1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_service_backbone:13.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_order_broker_cloud_service:5.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_order_broker_cloud_service:5.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_order_broker_cloud_service:15.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_store_inventory_management:14.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:health_sciences_clinical_development_center:3.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_order_broker_cloud_service:4.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_store_inventory_management:13.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_store_inventory_management:14.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_service_backbone:14.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_service_backbone:14.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_service_backbone:13.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_service_backbone:13.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:webcenter_sites:12.2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2015-3253"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-74"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html",
              "refsource": "MISC",
              "tags": [
                "Mitigation",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html"
            },
            {
              "name": "75919",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/75919"
            },
            {
              "name": "http://groovy-lang.org/security.html",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://groovy-lang.org/security.html"
            },
            {
              "name": "http://www.zerodayinitiative.com/advisories/ZDI-15-365/",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.zerodayinitiative.com/advisories/ZDI-15-365/"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"
            },
            {
              "name": "91787",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/91787"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
            },
            {
              "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"
            },
            {
              "name": "RHSA-2016:0066",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2016-0066.html"
            },
            {
              "name": "GLSA-201610-01",
              "refsource": "GENTOO",
              "tags": [],
              "url": "https://security.gentoo.org/glsa/201610-01"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
            },
            {
              "name": "1034815",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id/1034815"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20160623-0001/",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://security.netapp.com/advisory/ntap-20160623-0001/"
            },
            {
              "name": "RHSA-2017:2596",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2017:2596"
            },
            {
              "name": "RHSA-2017:2486",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2017:2486"
            },
            {
              "name": "RHSA-2016:1376",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2016:1376"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
            },
            {
              "name": "20150716 [CVE-2015-3253] Apache Groovy Zero-Day Vulnerability Disclosure",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/536012/100/0/threaded"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
              "refsource": "MISC",
              "tags": [],
              "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
            },
            {
              "name": "N/A",
              "refsource": "N/A",
              "tags": [],
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "[shardingsphere-notifications] 20200623 [GitHub] [shardingsphere] liuqiankun93 opened a new issue #6180: The groovy-2.4.5-indy.jar has High-level security risks",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed@%3Cnotifications.shardingsphere.apache.org%3E"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2020-06-24T05:15Z",
      "publishedDate": "2015-08-13T14:59Z"
    }
  }
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "JFrog Artifactory ist eine universelle DevOps-L\u00f6sung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX\n- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-1375 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1375.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-1375 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1375"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:5165 vom 2023-09-14",
        "url": "https://access.redhat.com/errata/RHSA-2023:5165"
      },
      {
        "category": "external",
        "summary": "JFrog Fixed Security Vulnerabilities vom 2022-09-11",
        "url": "https://www.jfrog.com/confluence/display/JFROG/Fixed+Security+Vulnerabilities"
      },
      {
        "category": "external",
        "summary": "JFrog Fixed Security Vulnerabilities",
        "url": "https://www.jfrog.com/confluence/display/JFROG/Fixed+Security+Vulnerabilities"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6782 vom 2022-10-04",
        "url": "https://access.redhat.com/errata/RHSA-2022:6782"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5776-1 vom 2022-12-13",
        "url": "https://ubuntu.com/security/notices/USN-5776-1"
      }
    ],
    "source_lang": "en-US",
    "title": "JFrog Artifactory: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-09-14T22:00:00.000+00:00",
      "generator": {
        "date": "2024-02-15T16:58:09.779+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2022-1375",
      "initial_release_date": "2022-09-11T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-09-11T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2022-10-03T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2022-10-04T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-12-12T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2022-12-20T23:00:00.000+00:00",
          "number": "5",
          "summary": "Referenz(en) aufgenommen: FEDORA-2022-DB674BAFD9, FEDORA-2022-7E327A20BE"
        },
        {
          "date": "2023-09-14T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "6"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "JFrog Artifactory",
                "product": {
                  "name": "JFrog Artifactory",
                  "product_id": "T024527",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:jfrog:artifactory:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "JFrog Artifactory \u003c 7.46.3",
                "product": {
                  "name": "JFrog Artifactory \u003c 7.46.3",
                  "product_id": "T024764",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:jfrog:artifactory:7.46.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Artifactory"
          }
        ],
        "category": "vendor",
        "name": "JFrog"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-4517",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2013-4517"
    },
    {
      "cve": "CVE-2013-7285",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2013-7285"
    },
    {
      "cve": "CVE-2014-0107",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2014-0107"
    },
    {
      "cve": "CVE-2014-0114",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2014-0114"
    },
    {
      "cve": "CVE-2014-3577",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2014-3577"
    },
    {
      "cve": "CVE-2014-3623",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2014-3623"
    },
    {
      "cve": "CVE-2015-0227",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2015-0227"
    },
    {
      "cve": "CVE-2015-2575",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2015-2575"
    },
    {
      "cve": "CVE-2015-3253",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2015-3253"
    },
    {
      "cve": "CVE-2015-4852",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2015-4852"
    },
    {
      "cve": "CVE-2015-7940",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2015-7940"
    },
    {
      "cve": "CVE-2016-10750",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2016-10750"
    },
    {
      "cve": "CVE-2016-3092",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2016-3092"
    },
    {
      "cve": "CVE-2016-3674",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2016-3674"
    },
    {
      "cve": "CVE-2016-6501",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2016-6501"
    },
    {
      "cve": "CVE-2016-8735",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2016-8735"
    },
    {
      "cve": "CVE-2016-8745",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2016-8745"
    },
    {
      "cve": "CVE-2017-1000487",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2017-1000487"
    },
    {
      "cve": "CVE-2017-15095",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2017-15095"
    },
    {
      "cve": "CVE-2017-17485",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2017-17485"
    },
    {
      "cve": "CVE-2017-18214",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2017-18214"
    },
    {
      "cve": "CVE-2017-18640",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2017-18640"
    },
    {
      "cve": "CVE-2017-7525",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2017-7525"
    },
    {
      "cve": "CVE-2017-7657",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2017-7657"
    },
    {
      "cve": "CVE-2017-7957",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2017-7957"
    },
    {
      "cve": "CVE-2017-9506",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2017-9506"
    },
    {
      "cve": "CVE-2018-1000206",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2018-1000206"
    },
    {
      "cve": "CVE-2018-9116",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2018-9116"
    },
    {
      "cve": "CVE-2019-10219",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2019-10219"
    },
    {
      "cve": "CVE-2019-12402",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2019-12402"
    },
    {
      "cve": "CVE-2019-17359",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2019-17359"
    },
    {
      "cve": "CVE-2019-17571",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2019-17571"
    },
    {
      "cve": "CVE-2019-20104",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2019-20104"
    },
    {
      "cve": "CVE-2020-11996",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2020-11996"
    },
    {
      "cve": "CVE-2020-13934",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2020-13934"
    },
    {
      "cve": "CVE-2020-13935",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2020-13935"
    },
    {
      "cve": "CVE-2020-13949",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2020-13949"
    },
    {
      "cve": "CVE-2020-14340",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2020-14340"
    },
    {
      "cve": "CVE-2020-15586",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2020-15586"
    },
    {
      "cve": "CVE-2020-1745",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2020-1745"
    },
    {
      "cve": "CVE-2020-17521",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2020-17521"
    },
    {
      "cve": "CVE-2020-25649",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2020-25649"
    },
    {
      "cve": "CVE-2020-28500",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2020-28500"
    },
    {
      "cve": "CVE-2020-29582",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2020-29582"
    },
    {
      "cve": "CVE-2020-36518",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2020-36518"
    },
    {
      "cve": "CVE-2020-7226",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2020-7226"
    },
    {
      "cve": "CVE-2020-7692",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2020-7692"
    },
    {
      "cve": "CVE-2020-8203",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2020-8203"
    },
    {
      "cve": "CVE-2021-13936",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-13936"
    },
    {
      "cve": "CVE-2021-21290",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-21290"
    },
    {
      "cve": "CVE-2021-22060",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-22060"
    },
    {
      "cve": "CVE-2021-22112",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-22112"
    },
    {
      "cve": "CVE-2021-22119",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-22119"
    },
    {
      "cve": "CVE-2021-22147",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-22147"
    },
    {
      "cve": "CVE-2021-22148",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-22148"
    },
    {
      "cve": "CVE-2021-22149",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-22149"
    },
    {
      "cve": "CVE-2021-22573",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-22573"
    },
    {
      "cve": "CVE-2021-23337",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-23337"
    },
    {
      "cve": "CVE-2021-25122",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-25122"
    },
    {
      "cve": "CVE-2021-26291",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-26291"
    },
    {
      "cve": "CVE-2021-27568",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-27568"
    },
    {
      "cve": "CVE-2021-29505",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-29505"
    },
    {
      "cve": "CVE-2021-30129",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-30129"
    },
    {
      "cve": "CVE-2021-33037",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-33037"
    },
    {
      "cve": "CVE-2021-35550",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-35550"
    },
    {
      "cve": "CVE-2021-35556",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-35556"
    },
    {
      "cve": "CVE-2021-35560",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-35560"
    },
    {
      "cve": "CVE-2021-35561",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-35561"
    },
    {
      "cve": "CVE-2021-35564",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-35564"
    },
    {
      "cve": "CVE-2021-35565",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-35565"
    },
    {
      "cve": "CVE-2021-35567",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-35567"
    },
    {
      "cve": "CVE-2021-35578",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-35578"
    },
    {
      "cve": "CVE-2021-35586",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-35586"
    },
    {
      "cve": "CVE-2021-35588",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-35588"
    },
    {
      "cve": "CVE-2021-35603",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-35603"
    },
    {
      "cve": "CVE-2021-36374",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-36374"
    },
    {
      "cve": "CVE-2021-3765",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-3765"
    },
    {
      "cve": "CVE-2021-3807",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-3807"
    },
    {
      "cve": "CVE-2021-38561",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-38561"
    },
    {
      "cve": "CVE-2021-3859",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-3859"
    },
    {
      "cve": "CVE-2021-41090",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-41090"
    },
    {
      "cve": "CVE-2021-41091",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-41091"
    },
    {
      "cve": "CVE-2021-42340",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-42340"
    },
    {
      "cve": "CVE-2021-42550",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-42550"
    },
    {
      "cve": "CVE-2021-43797",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2021-43797"
    },
    {
      "cve": "CVE-2022-0536",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2022-0536"
    },
    {
      "cve": "CVE-2022-22963",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2022-22963"
    },
    {
      "cve": "CVE-2022-23632",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2022-23632"
    },
    {
      "cve": "CVE-2022-23648",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2022-23648"
    },
    {
      "cve": "CVE-2022-23806",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2022-23806"
    },
    {
      "cve": "CVE-2022-24769",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2022-24769"
    },
    {
      "cve": "CVE-2022-24823",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2022-24823"
    },
    {
      "cve": "CVE-2022-27191",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2022-27191"
    },
    {
      "cve": "CVE-2022-29153",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2022-29153"
    },
    {
      "cve": "CVE-2022-32212",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2022-32212"
    },
    {
      "cve": "CVE-2022-32213",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2022-32213"
    },
    {
      "cve": "CVE-2022-32214",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2022-32214"
    },
    {
      "cve": "CVE-2022-32215",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2022-32215"
    },
    {
      "cve": "CVE-2022-32223",
      "notes": [
        {
          "category": "description",
          "text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T024527",
          "67646",
          "T000126",
          "T024764"
        ]
      },
      "release_date": "2022-09-11T22:00:00Z",
      "title": "CVE-2022-32223"
    }
  ]
}