{
   document: {
      acknowledgments: [
         {
            organization: "Hitachi ABB Power Grids",
            summary: "reporting this vulnerability to CISA",
         },
      ],
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Disclosure is not limited",
         tlp: {
            label: "WHITE",
            url: "https://us-cert.cisa.gov/tlp/",
         },
      },
      lang: "en-US",
      notes: [
         {
            category: "general",
            text: "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
            title: "CISA Disclaimer",
         },
         {
            category: "legal_disclaimer",
            text: "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
            title: "Legal Notice",
         },
         {
            category: "summary",
            text: "Successful exploitation of this vulnerability could allow an attacker to remotely take control of the product.",
            title: "Risk evaluation",
         },
         {
            category: "other",
            text: "Energy Sector",
            title: "Critical infrastructure sectors",
         },
         {
            category: "other",
            text: "Worldwide",
            title: "Countries/areas deployed",
         },
         {
            category: "other",
            text: "Switzerland",
            title: "Company headquarters location",
         },
         {
            category: "general",
            text: "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
            title: "Recommended Practices",
         },
         {
            category: "general",
            text: "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
            title: "Recommended Practices",
         },
         {
            category: "other",
            text: "No known public exploits specifically target this vulnerability.",
            title: "Exploitability",
         },
      ],
      publisher: {
         category: "coordinator",
         contact_details: "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
         name: "CISA",
         namespace: "https://www.cisa.gov/",
      },
      references: [
         {
            category: "self",
            summary: "ICS Advisory ICSA-20-294-02 JSON",
            url: "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsa-20-294-02.json",
         },
         {
            category: "self",
            summary: "ICS Advisory ICSA-20-294-02 Web Version",
            url: "https://www.cisa.gov/news-events/ics-advisories/icsa-20-294-02",
         },
         {
            category: "external",
            summary: "Recommended Practices",
            url: "https://www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf",
         },
         {
            category: "external",
            summary: "Recommended Practices",
            url: "https://www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B",
         },
      ],
      title: "Hitachi ABB Power Grids XMC20 Multiservice-Multiplexer",
      tracking: {
         current_release_date: "2020-10-20T00:00:00.000000Z",
         generator: {
            engine: {
               name: "CISA CSAF Generator",
               version: "1.0.0",
            },
         },
         id: "ICSA-20-294-02",
         initial_release_date: "2020-10-20T00:00:00.000000Z",
         revision_history: [
            {
               date: "2020-10-20T00:00:00.000000Z",
               legacy_version: "Initial",
               number: "1",
               summary: "ICSA-20-294-02 Hitachi ABB Power Grids XMC20 Multiservice-Multiplexer",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "< co5ne_r2d14_03.esw",
                        product: {
                           name: "XMC20 R6 using COGE5: versions older than co5ne_r2d14_03.esw",
                           product_id: "CSAFPID-0001",
                        },
                     },
                  ],
                  category: "product_name",
                  name: "XMC20 R6 using COGE5",
               },
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "<co5ne_r1h07_12.esw",
                        product: {
                           name: "XMC20 R4 using COGE5: versions older than co5ne_r1h07_12.esw",
                           product_id: "CSAFPID-0002",
                        },
                     },
                  ],
                  category: "product_name",
                  name: "XMC20 R4 using COGE5",
               },
            ],
            category: "vendor",
            name: "Hitachi Energy",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2018-10933",
         cwe: {
            id: "CWE-287",
            name: "Improper Authentication",
         },
         notes: [
            {
               category: "summary",
               text: "A vulnerability exists in a specific library included in these products. An attacker could exploit the vulnerability by sending a specially crafted message to the XMC20 node to open a communication channel without first performing authentication, resulting in unauthorized access.CVE-2018-10933 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).",
               title: "Vulnerability Summary",
            },
         ],
         product_status: {
            known_affected: [
               "CSAFPID-0001",
               "CSAFPID-0002",
            ],
         },
         references: [
            {
               category: "external",
               summary: "web.nvd.nist.gov",
               url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-10933",
            },
            {
               category: "external",
               summary: "www.first.org",
               url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            },
         ],
         remediations: [
            {
               category: "mitigation",
               details: "Hitachi ABB Power Grids has corrected the problem in the following product versions and recommends users apply the firmware update at the earliest availability",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "XMC20 R4: COGE5 Version co5ne_r1h07_12.esw (and newer)",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "XMC20 R6: COGE5 Version co5ne_r2d14_03.esw (and newer)",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "For additional information and support please contact a product provider or a Hitachi ABB Power Grids service organization.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
               url: "https://www.hitachiabb-powergrids.com/contact-us/",
            },
            {
               category: "mitigation",
               details: "Hitachi ABB Power Grids published cybersecurity advisory PGVU-PGGA-XMC20-2020034 to give users more information about this issue.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
               url: "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A2862&LanguageCode=en&DocumentPartId=&Action=Launch",
            },
            {
               category: "mitigation",
               details: "Physically protect process control systems from direct access by unauthorized personnel.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "Do not directly connect control systems to the Internet.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "Separate control systems from other networks by means of a firewall system that has a minimal number of ports exposed.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "Do not use control systems networks for Internet browsing, instant messaging, or receiving e-mails.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.1,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.0",
               },
               products: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
         ],
      },
   ],
}

{
   document: {
      acknowledgments: [
         {
            organization: "Hitachi ABB Power Grids",
            summary: "reporting this vulnerability to CISA",
         },
      ],
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Disclosure is not limited",
         tlp: {
            label: "WHITE",
            url: "https://us-cert.cisa.gov/tlp/",
         },
      },
      lang: "en-US",
      notes: [
         {
            category: "general",
            text: "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
            title: "CISA Disclaimer",
         },
         {
            category: "legal_disclaimer",
            text: "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
            title: "Legal Notice",
         },
         {
            category: "summary",
            text: "Successful exploitation of this vulnerability could allow an attacker remote access to the device without authentication.",
            title: "Risk evaluation",
         },
         {
            category: "other",
            text: "Energy",
            title: "Critical infrastructure sectors",
         },
         {
            category: "other",
            text: "Worldwide",
            title: "Countries/areas deployed",
         },
         {
            category: "other",
            text: "Switzerland",
            title: "Company headquarters location",
         },
         {
            category: "general",
            text: "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:",
            title: "Recommended Practices",
         },
         {
            category: "general",
            text: "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
            title: "Recommended Practices",
         },
         {
            category: "general",
            text: "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
            title: "Recommended Practices",
         },
         {
            category: "other",
            text: "No known public exploits specifically target this vulnerability.",
            title: "Exploitability",
         },
      ],
      publisher: {
         category: "coordinator",
         contact_details: "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
         name: "CISA",
         namespace: "https://www.cisa.gov/",
      },
      references: [
         {
            category: "self",
            summary: "ICS Advisory ICSA-21-007-01 JSON",
            url: "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-007-01.json",
         },
         {
            category: "self",
            summary: "ICS Advisory ICSA-21-007-01 Web Version",
            url: "https://www.cisa.gov/news-events/ics-advisories/icsa-21-007-01",
         },
         {
            category: "external",
            summary: "Recommended Practices",
            url: "https://www.cisa.gov/news-events/ics-advisories/icsa-21-007-01",
         },
         {
            category: "external",
            summary: "Recommended Practices",
            url: "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf",
         },
         {
            category: "external",
            summary: "Recommended Practices",
            url: "https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B",
         },
      ],
      title: "Hitachi ABB Power Grids FOX615 Multiservice-Multiplexer",
      tracking: {
         current_release_date: "2021-01-07T00:00:00.000000Z",
         generator: {
            engine: {
               name: "CISA CSAF Generator",
               version: "1.0.0",
            },
         },
         id: "ICSA-21-007-01",
         initial_release_date: "2021-01-07T00:00:00.000000Z",
         revision_history: [
            {
               date: "2021-01-07T00:00:00.000000Z",
               legacy_version: "Initial",
               number: "1",
               summary: "ICSA-21-007-01 Hitachi ABB Power Grids FOX615 Multiservice-Multiplexer",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "< cesne_r2d14_03.esw",
                        product: {
                           name: "FOX61x R2 using CESM1/CESM2: All versions prior to cesne_r2d14_03.esw",
                           product_id: "CSAFPID-0001",
                        },
                     },
                  ],
                  category: "product_name",
                  name: "FOX61x R2 using CESM1/CESM2",
               },
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "< cesne_r1h07_12.esw",
                        product: {
                           name: "FOX61x R1 using CESM1/CESM2: All versions prior to cesne_r1h07_12.esw",
                           product_id: "CSAFPID-0002",
                        },
                     },
                  ],
                  category: "product_name",
                  name: "FOX61x R1 using CESM1/CESM2",
               },
            ],
            category: "vendor",
            name: "Hitachi Energy",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2018-10933",
         cwe: {
            id: "CWE-287",
            name: "Improper Authentication",
         },
         notes: [
            {
               category: "summary",
               text: "An attacker can send a specially crafted message to the device causing it to open a communication channel without first performing authentication, which may allow an attacker to execute arbitrary commands.CVE-2018-10933 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).",
               title: "Vulnerability Summary",
            },
         ],
         product_status: {
            known_affected: [
               "CSAFPID-0001",
               "CSAFPID-0002",
            ],
         },
         references: [
            {
               category: "external",
               summary: "web.nvd.nist.gov",
               url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-10933",
            },
            {
               category: "external",
               summary: "www.first.org",
               url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            },
         ],
         remediations: [
            {
               category: "mitigation",
               details: "Hitachi ABB Power Grids recommends users apply the following firmware: FOX61x R1: CESM1/CESM2: Update to Version cesne_r1h07_12.esw or newer",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "Hitachi ABB Power Grids recommends users apply the following firmware: FOX61x R2: CESM1/CESM2: Update to Version cesne_r2d14_03.esw or newer",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "For additional information and support please contact a product provider or Hitachi ABB Power Grids service organization.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
               url: "https://www.hitachiabb-powergrids.com/contact-us/",
            },
            {
               category: "mitigation",
               details: "Hitachi ABB Power Grids recommends security practices and firewall configurations to help protect a process control network from attacks originating from outside the network. Such practices require process control systems be physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by a firewall system that has a minimal number of ports exposed. Other systems must be evaluated on case-by-case basis. Process control systems should not be used for Internet browsing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.1,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.0",
               },
               products: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
         ],
      },
   ],
}

{
   document: {
      acknowledgments: [
         {
            organization: "Hitachi ABB Power Grids",
            summary: "reporting this vulnerability to CISA",
         },
      ],
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Disclosure is not limited",
         tlp: {
            label: "WHITE",
            url: "https://us-cert.cisa.gov/tlp/",
         },
      },
      lang: "en-US",
      notes: [
         {
            category: "general",
            text: "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
            title: "CISA Disclaimer",
         },
         {
            category: "legal_disclaimer",
            text: "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
            title: "Legal Notice",
         },
         {
            category: "summary",
            text: "Successful exploitation of this vulnerability could allow an attacker remote access to the device without authentication.",
            title: "Risk evaluation",
         },
         {
            category: "other",
            text: "Energy",
            title: "Critical infrastructure sectors",
         },
         {
            category: "other",
            text: "Worldwide",
            title: "Countries/areas deployed",
         },
         {
            category: "other",
            text: "Switzerland",
            title: "Company headquarters location",
         },
         {
            category: "general",
            text: "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:",
            title: "Recommended Practices",
         },
         {
            category: "general",
            text: "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
            title: "Recommended Practices",
         },
         {
            category: "general",
            text: "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
            title: "Recommended Practices",
         },
         {
            category: "other",
            text: "No known public exploits specifically target this vulnerability.",
            title: "Exploitability",
         },
      ],
      publisher: {
         category: "coordinator",
         contact_details: "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
         name: "CISA",
         namespace: "https://www.cisa.gov/",
      },
      references: [
         {
            category: "self",
            summary: "ICS Advisory ICSA-21-007-01 JSON",
            url: "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-007-01.json",
         },
         {
            category: "self",
            summary: "ICS Advisory ICSA-21-007-01 Web Version",
            url: "https://www.cisa.gov/news-events/ics-advisories/icsa-21-007-01",
         },
         {
            category: "external",
            summary: "Recommended Practices",
            url: "https://www.cisa.gov/news-events/ics-advisories/icsa-21-007-01",
         },
         {
            category: "external",
            summary: "Recommended Practices",
            url: "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf",
         },
         {
            category: "external",
            summary: "Recommended Practices",
            url: "https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B",
         },
      ],
      title: "Hitachi ABB Power Grids FOX615 Multiservice-Multiplexer",
      tracking: {
         current_release_date: "2021-01-07T00:00:00.000000Z",
         generator: {
            engine: {
               name: "CISA CSAF Generator",
               version: "1.0.0",
            },
         },
         id: "ICSA-21-007-01",
         initial_release_date: "2021-01-07T00:00:00.000000Z",
         revision_history: [
            {
               date: "2021-01-07T00:00:00.000000Z",
               legacy_version: "Initial",
               number: "1",
               summary: "ICSA-21-007-01 Hitachi ABB Power Grids FOX615 Multiservice-Multiplexer",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "< cesne_r2d14_03.esw",
                        product: {
                           name: "FOX61x R2 using CESM1/CESM2: All versions prior to cesne_r2d14_03.esw",
                           product_id: "CSAFPID-0001",
                        },
                     },
                  ],
                  category: "product_name",
                  name: "FOX61x R2 using CESM1/CESM2",
               },
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "< cesne_r1h07_12.esw",
                        product: {
                           name: "FOX61x R1 using CESM1/CESM2: All versions prior to cesne_r1h07_12.esw",
                           product_id: "CSAFPID-0002",
                        },
                     },
                  ],
                  category: "product_name",
                  name: "FOX61x R1 using CESM1/CESM2",
               },
            ],
            category: "vendor",
            name: "Hitachi Energy",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2018-10933",
         cwe: {
            id: "CWE-287",
            name: "Improper Authentication",
         },
         notes: [
            {
               category: "summary",
               text: "An attacker can send a specially crafted message to the device causing it to open a communication channel without first performing authentication, which may allow an attacker to execute arbitrary commands.CVE-2018-10933 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).",
               title: "Vulnerability Summary",
            },
         ],
         product_status: {
            known_affected: [
               "CSAFPID-0001",
               "CSAFPID-0002",
            ],
         },
         references: [
            {
               category: "external",
               summary: "web.nvd.nist.gov",
               url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-10933",
            },
            {
               category: "external",
               summary: "www.first.org",
               url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            },
         ],
         remediations: [
            {
               category: "mitigation",
               details: "Hitachi ABB Power Grids recommends users apply the following firmware: FOX61x R1: CESM1/CESM2: Update to Version cesne_r1h07_12.esw or newer",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "Hitachi ABB Power Grids recommends users apply the following firmware: FOX61x R2: CESM1/CESM2: Update to Version cesne_r2d14_03.esw or newer",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "For additional information and support please contact a product provider or Hitachi ABB Power Grids service organization.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
               url: "https://www.hitachiabb-powergrids.com/contact-us/",
            },
            {
               category: "mitigation",
               details: "Hitachi ABB Power Grids recommends security practices and firewall configurations to help protect a process control network from attacks originating from outside the network. Such practices require process control systems be physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by a firewall system that has a minimal number of ports exposed. Other systems must be evaluated on case-by-case basis. Process control systems should not be used for Internet browsing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.1,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.0",
               },
               products: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
         ],
      },
   ],
}

{
   document: {
      acknowledgments: [
         {
            organization: "Hitachi ABB Power Grids",
            summary: "reporting this vulnerability to CISA",
         },
      ],
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Disclosure is not limited",
         tlp: {
            label: "WHITE",
            url: "https://us-cert.cisa.gov/tlp/",
         },
      },
      lang: "en-US",
      notes: [
         {
            category: "general",
            text: "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
            title: "CISA Disclaimer",
         },
         {
            category: "legal_disclaimer",
            text: "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
            title: "Legal Notice",
         },
         {
            category: "summary",
            text: "Successful exploitation of this vulnerability could allow an attacker to remotely take control of the product.",
            title: "Risk evaluation",
         },
         {
            category: "other",
            text: "Energy Sector",
            title: "Critical infrastructure sectors",
         },
         {
            category: "other",
            text: "Worldwide",
            title: "Countries/areas deployed",
         },
         {
            category: "other",
            text: "Switzerland",
            title: "Company headquarters location",
         },
         {
            category: "general",
            text: "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
            title: "Recommended Practices",
         },
         {
            category: "general",
            text: "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
            title: "Recommended Practices",
         },
         {
            category: "other",
            text: "No known public exploits specifically target this vulnerability.",
            title: "Exploitability",
         },
      ],
      publisher: {
         category: "coordinator",
         contact_details: "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
         name: "CISA",
         namespace: "https://www.cisa.gov/",
      },
      references: [
         {
            category: "self",
            summary: "ICS Advisory ICSA-20-294-02 JSON",
            url: "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsa-20-294-02.json",
         },
         {
            category: "self",
            summary: "ICS Advisory ICSA-20-294-02 Web Version",
            url: "https://www.cisa.gov/news-events/ics-advisories/icsa-20-294-02",
         },
         {
            category: "external",
            summary: "Recommended Practices",
            url: "https://www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf",
         },
         {
            category: "external",
            summary: "Recommended Practices",
            url: "https://www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B",
         },
      ],
      title: "Hitachi ABB Power Grids XMC20 Multiservice-Multiplexer",
      tracking: {
         current_release_date: "2020-10-20T00:00:00.000000Z",
         generator: {
            engine: {
               name: "CISA CSAF Generator",
               version: "1.0.0",
            },
         },
         id: "ICSA-20-294-02",
         initial_release_date: "2020-10-20T00:00:00.000000Z",
         revision_history: [
            {
               date: "2020-10-20T00:00:00.000000Z",
               legacy_version: "Initial",
               number: "1",
               summary: "ICSA-20-294-02 Hitachi ABB Power Grids XMC20 Multiservice-Multiplexer",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "< co5ne_r2d14_03.esw",
                        product: {
                           name: "XMC20 R6 using COGE5: versions older than co5ne_r2d14_03.esw",
                           product_id: "CSAFPID-0001",
                        },
                     },
                  ],
                  category: "product_name",
                  name: "XMC20 R6 using COGE5",
               },
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "<co5ne_r1h07_12.esw",
                        product: {
                           name: "XMC20 R4 using COGE5: versions older than co5ne_r1h07_12.esw",
                           product_id: "CSAFPID-0002",
                        },
                     },
                  ],
                  category: "product_name",
                  name: "XMC20 R4 using COGE5",
               },
            ],
            category: "vendor",
            name: "Hitachi Energy",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2018-10933",
         cwe: {
            id: "CWE-287",
            name: "Improper Authentication",
         },
         notes: [
            {
               category: "summary",
               text: "A vulnerability exists in a specific library included in these products. An attacker could exploit the vulnerability by sending a specially crafted message to the XMC20 node to open a communication channel without first performing authentication, resulting in unauthorized access.CVE-2018-10933 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).",
               title: "Vulnerability Summary",
            },
         ],
         product_status: {
            known_affected: [
               "CSAFPID-0001",
               "CSAFPID-0002",
            ],
         },
         references: [
            {
               category: "external",
               summary: "web.nvd.nist.gov",
               url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-10933",
            },
            {
               category: "external",
               summary: "www.first.org",
               url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            },
         ],
         remediations: [
            {
               category: "mitigation",
               details: "Hitachi ABB Power Grids has corrected the problem in the following product versions and recommends users apply the firmware update at the earliest availability",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "XMC20 R4: COGE5 Version co5ne_r1h07_12.esw (and newer)",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "XMC20 R6: COGE5 Version co5ne_r2d14_03.esw (and newer)",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "For additional information and support please contact a product provider or a Hitachi ABB Power Grids service organization.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
               url: "https://www.hitachiabb-powergrids.com/contact-us/",
            },
            {
               category: "mitigation",
               details: "Hitachi ABB Power Grids published cybersecurity advisory PGVU-PGGA-XMC20-2020034 to give users more information about this issue.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
               url: "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A2862&LanguageCode=en&DocumentPartId=&Action=Launch",
            },
            {
               category: "mitigation",
               details: "Physically protect process control systems from direct access by unauthorized personnel.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "Do not directly connect control systems to the Internet.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "Separate control systems from other networks by means of a firewall system that has a minimal number of ports exposed.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "Do not use control systems networks for Internet browsing, instant messaging, or receiving e-mails.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
            {
               category: "mitigation",
               details: "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.1,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.0",
               },
               products: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
               ],
            },
         ],
      },
   ],
}

{
   GSD: {
      alias: "CVE-2018-10933",
      description: "A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.",
      id: "GSD-2018-10933",
      references: [
         "https://www.suse.com/security/cve/CVE-2018-10933.html",
         "https://www.debian.org/security/2018/dsa-4322",
         "https://access.redhat.com/errata/RHBA-2018:3712",
         "https://ubuntu.com/security/CVE-2018-10933",
         "https://advisories.mageia.org/CVE-2018-10933.html",
         "https://security.archlinux.org/CVE-2018-10933",
         "https://packetstormsecurity.com/files/cve/CVE-2018-10933",
      ],
   },
   gsd: {
      metadata: {
         exploitCode: "unknown",
         remediation: "unknown",
         reportConfidence: "confirmed",
         type: "vulnerability",
      },
      osvSchema: {
         aliases: [
            "CVE-2018-10933",
         ],
         details: "A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.",
         id: "GSD-2018-10933",
         modified: "2023-12-13T01:22:41.192134Z",
         schema_version: "1.4.0",
      },
   },
   namespaces: {
      "cve.org": {
         CVE_data_meta: {
            ASSIGNER: "secalert@redhat.com",
            ID: "CVE-2018-10933",
            STATE: "PUBLIC",
         },
         affects: {
            vendor: {
               vendor_data: [
                  {
                     product: {
                        product_data: [
                           {
                              product_name: "libssh",
                              version: {
                                 version_data: [
                                    {
                                       version_value: "0.7.6",
                                    },
                                    {
                                       version_value: "0.8.4",
                                    },
                                 ],
                              },
                           },
                        ],
                     },
                     vendor_name: "[UNKNOWN]",
                  },
               ],
            },
         },
         data_format: "MITRE",
         data_type: "CVE",
         data_version: "4.0",
         description: {
            description_data: [
               {
                  lang: "eng",
                  value: "A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.",
               },
            ],
         },
         impact: {
            cvss: [
               [
                  {
                     vectorString: "9.1/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                     version: "3.0",
                  },
               ],
            ],
         },
         problemtype: {
            problemtype_data: [
               {
                  description: [
                     {
                        lang: "eng",
                        value: "CWE-592",
                     },
                  ],
               },
            ],
         },
         references: {
            reference_data: [
               {
                  name: "USN-3795-1",
                  refsource: "UBUNTU",
                  url: "https://usn.ubuntu.com/3795-1/",
               },
               {
                  name: "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
                  refsource: "CONFIRM",
                  url: "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
               },
               {
                  name: "USN-3795-2",
                  refsource: "UBUNTU",
                  url: "https://usn.ubuntu.com/3795-2/",
               },
               {
                  name: "DSA-4322",
                  refsource: "DEBIAN",
                  url: "https://www.debian.org/security/2018/dsa-4322",
               },
               {
                  name: "45638",
                  refsource: "EXPLOIT-DB",
                  url: "https://www.exploit-db.com/exploits/45638/",
               },
               {
                  name: "https://www.libssh.org/security/advisories/CVE-2018-10933.txt",
                  refsource: "CONFIRM",
                  url: "https://www.libssh.org/security/advisories/CVE-2018-10933.txt",
               },
               {
                  name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10933",
                  refsource: "CONFIRM",
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10933",
               },
               {
                  name: "105677",
                  refsource: "BID",
                  url: "http://www.securityfocus.com/bid/105677",
               },
               {
                  name: "[debian-lts-announce] 20181018 [SECURITY] [DLA 1548-1] libssh security update",
                  refsource: "MLIST",
                  url: "https://lists.debian.org/debian-lts-announce/2018/10/msg00010.html",
               },
               {
                  name: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0016",
                  refsource: "CONFIRM",
                  url: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0016",
               },
               {
                  name: "https://security.netapp.com/advisory/ntap-20190118-0002/",
                  refsource: "CONFIRM",
                  url: "https://security.netapp.com/advisory/ntap-20190118-0002/",
               },
            ],
         },
      },
      "nvd.nist.gov": {
         configurations: {
            CVE_data_version: "4.0",
            nodes: [
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*",
                        cpe_name: [],
                        versionEndExcluding: "0.8.4",
                        versionStartIncluding: "0.8.0",
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*",
                        cpe_name: [],
                        versionEndExcluding: "0.7.6",
                        versionStartIncluding: "0.6.0",
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vsphere:*:*",
                        cpe_name: [],
                        versionStartIncluding: "9.4",
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:*",
                        cpe_name: [],
                        versionStartIncluding: "7.3",
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*",
                        cpe_name: [],
                        versionEndIncluding: "8.0.13",
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
            ],
         },
         cve: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2018-10933",
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "en",
                     value: "A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "en",
                           value: "CWE-287",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.libssh.org/security/advisories/CVE-2018-10933.txt",
                     refsource: "CONFIRM",
                     tags: [
                        "Vendor Advisory",
                     ],
                     url: "https://www.libssh.org/security/advisories/CVE-2018-10933.txt",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10933",
                     refsource: "CONFIRM",
                     tags: [
                        "Issue Tracking",
                        "Third Party Advisory",
                     ],
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10933",
                  },
                  {
                     name: "DSA-4322",
                     refsource: "DEBIAN",
                     tags: [
                        "Third Party Advisory",
                     ],
                     url: "https://www.debian.org/security/2018/dsa-4322",
                  },
                  {
                     name: "USN-3795-1",
                     refsource: "UBUNTU",
                     tags: [
                        "Third Party Advisory",
                     ],
                     url: "https://usn.ubuntu.com/3795-1/",
                  },
                  {
                     name: "[debian-lts-announce] 20181018 [SECURITY] [DLA 1548-1] libssh security update",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Third Party Advisory",
                     ],
                     url: "https://lists.debian.org/debian-lts-announce/2018/10/msg00010.html",
                  },
                  {
                     name: "45638",
                     refsource: "EXPLOIT-DB",
                     tags: [
                        "Exploit",
                        "Third Party Advisory",
                        "VDB Entry",
                     ],
                     url: "https://www.exploit-db.com/exploits/45638/",
                  },
                  {
                     name: "105677",
                     refsource: "BID",
                     tags: [
                        "Third Party Advisory",
                        "VDB Entry",
                     ],
                     url: "http://www.securityfocus.com/bid/105677",
                  },
                  {
                     name: "USN-3795-2",
                     refsource: "UBUNTU",
                     tags: [
                        "Third Party Advisory",
                     ],
                     url: "https://usn.ubuntu.com/3795-2/",
                  },
                  {
                     name: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0016",
                     refsource: "CONFIRM",
                     tags: [
                        "Third Party Advisory",
                     ],
                     url: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0016",
                  },
                  {
                     name: "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
                     refsource: "CONFIRM",
                     tags: [
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20190118-0002/",
                     refsource: "CONFIRM",
                     tags: [
                        "Third Party Advisory",
                     ],
                     url: "https://security.netapp.com/advisory/ntap-20190118-0002/",
                  },
               ],
            },
         },
         impact: {
            baseMetricV2: {
               acInsufInfo: false,
               cvssV2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 6.4,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               exploitabilityScore: 10,
               impactScore: 4.9,
               obtainAllPrivilege: false,
               obtainOtherPrivilege: false,
               obtainUserPrivilege: false,
               severity: "MEDIUM",
               userInteractionRequired: false,
            },
            baseMetricV3: {
               cvssV3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 9.1,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.0",
               },
               exploitabilityScore: 3.9,
               impactScore: 5.2,
            },
         },
         lastModifiedDate: "2019-10-09T23:33Z",
         publishedDate: "2018-10-17T12:29Z",
      },
   },
}

{
   document: {
      aggregate_severity: {
         text: "hoch",
      },
      category: "csaf_base",
      csaf_version: "2.0",
      distribution: {
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "de-DE",
      notes: [
         {
            category: "legal_disclaimer",
            text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.",
         },
         {
            category: "description",
            text: "libssh ist eine C Bibliothek für das Anbieten von SSH Diensten auf Client- und Serverseite. Sie kann genutzt werden, um aus der Ferne Programme auszuführen, Dateien zu übertragen oder als sicherer und transparenter Tunnel für entfernte Programme genutzt werden.",
            title: "Produktbeschreibung",
         },
         {
            category: "summary",
            text: "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in libssh ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
            title: "Angriff",
         },
         {
            category: "general",
            text: "- Linux\n- UNIX",
            title: "Betroffene Betriebssysteme",
         },
      ],
      publisher: {
         category: "other",
         contact_details: "csaf-provider@cert-bund.de",
         name: "Bundesamt für Sicherheit in der Informationstechnik",
         namespace: "https://www.bsi.bund.de",
      },
      references: [
         {
            category: "self",
            summary: "WID-SEC-W-2024-1051 - CSAF Version",
            url: "https://wid.cert-bund.de/.well-known/csaf/white/2018/wid-sec-w-2024-1051.json",
         },
         {
            category: "self",
            summary: "WID-SEC-2024-1051 - Portal Version",
            url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1051",
         },
         {
            category: "external",
            summary: "libssh Release Notes vom 2018-10-16",
            url: "https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/",
         },
         {
            category: "external",
            summary: "Debian Security Advisory DSA-4322-1 vom 2018-10-17",
            url: "https://lists.debian.org/debian-security-announce/2018/msg00253.html",
         },
         {
            category: "external",
            summary: "Debian Security Advisory DSA-4322 vom 2018-10-18",
            url: "https://www.debian.org/security/2018/dsa-4322",
         },
         {
            category: "external",
            summary: "Ubuntu Security Notice USN-3795-1 vom 2018-10-18",
            url: "http://www.ubuntu.com/usn/usn-3795-1",
         },
         {
            category: "external",
            summary: "Dell Security Advisory DSA-2024-198 vom 2024-05-08",
            url: "https://www.dell.com/support/kbdoc/000224827/dsa-2024-=",
         },
      ],
      source_lang: "en-US",
      title: "libssh: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen",
      tracking: {
         current_release_date: "2024-05-07T22:00:00.000+00:00",
         generator: {
            date: "2024-08-15T18:08:36.269+00:00",
            engine: {
               name: "BSI-WID",
               version: "1.3.5",
            },
         },
         id: "WID-SEC-W-2024-1051",
         initial_release_date: "2018-10-16T22:00:00.000+00:00",
         revision_history: [
            {
               date: "2018-10-16T22:00:00.000+00:00",
               number: "1",
               summary: "Initial Release",
            },
            {
               date: "2018-10-17T22:00:00.000+00:00",
               number: "2",
               summary: "Added references",
            },
            {
               date: "2018-10-17T22:00:00.000+00:00",
               number: "3",
               summary: "New remediations available",
            },
            {
               date: "2018-10-18T22:00:00.000+00:00",
               number: "4",
               summary: "New remediations available",
            },
            {
               date: "2018-10-21T22:00:00.000+00:00",
               number: "5",
               summary: "New remediations available",
            },
            {
               date: "2018-10-23T22:00:00.000+00:00",
               number: "6",
               summary: "Anpassung",
            },
            {
               date: "2024-05-07T22:00:00.000+00:00",
               number: "7",
               summary: "Neue Updates von Dell aufgenommen",
            },
         ],
         status: "final",
         version: "7",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  category: "product_name",
                  name: "Debian Linux",
                  product: {
                     name: "Debian Linux",
                     product_id: "2951",
                     product_identification_helper: {
                        cpe: "cpe:/o:debian:debian_linux:-",
                     },
                  },
               },
            ],
            category: "vendor",
            name: "Debian",
         },
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "virtual",
                        product: {
                           name: "Dell NetWorker virtual",
                           product_id: "T034583",
                           product_identification_helper: {
                              cpe: "cpe:/a:dell:networker:virtual",
                           },
                        },
                     },
                  ],
                  category: "product_name",
                  name: "NetWorker",
               },
            ],
            category: "vendor",
            name: "Dell",
         },
         {
            branches: [
               {
                  category: "product_name",
                  name: "EMC Avamar",
                  product: {
                     name: "EMC Avamar",
                     product_id: "T014381",
                     product_identification_helper: {
                        cpe: "cpe:/a:emc:avamar:-",
                     },
                  },
               },
            ],
            category: "vendor",
            name: "EMC",
         },
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "<0.8.4",
                        product: {
                           name: "Open Source libssh <0.8.4",
                           product_id: "T012886",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "<0.7.6",
                        product: {
                           name: "Open Source libssh <0.7.6",
                           product_id: "T012887",
                        },
                     },
                  ],
                  category: "product_name",
                  name: "libssh",
               },
            ],
            category: "vendor",
            name: "Open Source",
         },
         {
            branches: [
               {
                  category: "product_name",
                  name: "Ubuntu Linux",
                  product: {
                     name: "Ubuntu Linux",
                     product_id: "T000126",
                     product_identification_helper: {
                        cpe: "cpe:/o:canonical:ubuntu_linux:-",
                     },
                  },
               },
            ],
            category: "vendor",
            name: "Ubuntu",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2018-10933",
         notes: [
            {
               category: "description",
               text: "Es existiert eine Schwachstelle in libssh. Ein entfernter anonymer Angreifer kann durch das Senden speziell bearbeiteter Nachrichten die Authentisierung umgehen und sich so ohne Zugangsdaten erfolgreich authentifizieren.",
            },
         ],
         product_status: {
            known_affected: [
               "T014381",
               "2951",
               "T000126",
               "T034583",
            ],
         },
         release_date: "2018-10-16T22:00:00.000+00:00",
         title: "CVE-2018-10933",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         text: "hoch",
      },
      category: "csaf_base",
      csaf_version: "2.0",
      distribution: {
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "de-DE",
      notes: [
         {
            category: "legal_disclaimer",
            text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.",
         },
         {
            category: "description",
            text: "libssh ist eine C Bibliothek für das Anbieten von SSH Diensten auf Client- und Serverseite. Sie kann genutzt werden, um aus der Ferne Programme auszuführen, Dateien zu übertragen oder als sicherer und transparenter Tunnel für entfernte Programme genutzt werden.",
            title: "Produktbeschreibung",
         },
         {
            category: "summary",
            text: "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in libssh ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
            title: "Angriff",
         },
         {
            category: "general",
            text: "- Linux\n- UNIX",
            title: "Betroffene Betriebssysteme",
         },
      ],
      publisher: {
         category: "other",
         contact_details: "csaf-provider@cert-bund.de",
         name: "Bundesamt für Sicherheit in der Informationstechnik",
         namespace: "https://www.bsi.bund.de",
      },
      references: [
         {
            category: "self",
            summary: "WID-SEC-W-2024-1051 - CSAF Version",
            url: "https://wid.cert-bund.de/.well-known/csaf/white/2018/wid-sec-w-2024-1051.json",
         },
         {
            category: "self",
            summary: "WID-SEC-2024-1051 - Portal Version",
            url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1051",
         },
         {
            category: "external",
            summary: "libssh Release Notes vom 2018-10-16",
            url: "https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/",
         },
         {
            category: "external",
            summary: "Debian Security Advisory DSA-4322-1 vom 2018-10-17",
            url: "https://lists.debian.org/debian-security-announce/2018/msg00253.html",
         },
         {
            category: "external",
            summary: "Debian Security Advisory DSA-4322 vom 2018-10-18",
            url: "https://www.debian.org/security/2018/dsa-4322",
         },
         {
            category: "external",
            summary: "Ubuntu Security Notice USN-3795-1 vom 2018-10-18",
            url: "http://www.ubuntu.com/usn/usn-3795-1",
         },
         {
            category: "external",
            summary: "Dell Security Advisory DSA-2024-198 vom 2024-05-08",
            url: "https://www.dell.com/support/kbdoc/000224827/dsa-2024-=",
         },
      ],
      source_lang: "en-US",
      title: "libssh: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen",
      tracking: {
         current_release_date: "2024-05-07T22:00:00.000+00:00",
         generator: {
            date: "2024-08-15T18:08:36.269+00:00",
            engine: {
               name: "BSI-WID",
               version: "1.3.5",
            },
         },
         id: "WID-SEC-W-2024-1051",
         initial_release_date: "2018-10-16T22:00:00.000+00:00",
         revision_history: [
            {
               date: "2018-10-16T22:00:00.000+00:00",
               number: "1",
               summary: "Initial Release",
            },
            {
               date: "2018-10-17T22:00:00.000+00:00",
               number: "2",
               summary: "Added references",
            },
            {
               date: "2018-10-17T22:00:00.000+00:00",
               number: "3",
               summary: "New remediations available",
            },
            {
               date: "2018-10-18T22:00:00.000+00:00",
               number: "4",
               summary: "New remediations available",
            },
            {
               date: "2018-10-21T22:00:00.000+00:00",
               number: "5",
               summary: "New remediations available",
            },
            {
               date: "2018-10-23T22:00:00.000+00:00",
               number: "6",
               summary: "Anpassung",
            },
            {
               date: "2024-05-07T22:00:00.000+00:00",
               number: "7",
               summary: "Neue Updates von Dell aufgenommen",
            },
         ],
         status: "final",
         version: "7",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  category: "product_name",
                  name: "Debian Linux",
                  product: {
                     name: "Debian Linux",
                     product_id: "2951",
                     product_identification_helper: {
                        cpe: "cpe:/o:debian:debian_linux:-",
                     },
                  },
               },
            ],
            category: "vendor",
            name: "Debian",
         },
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "virtual",
                        product: {
                           name: "Dell NetWorker virtual",
                           product_id: "T034583",
                           product_identification_helper: {
                              cpe: "cpe:/a:dell:networker:virtual",
                           },
                        },
                     },
                  ],
                  category: "product_name",
                  name: "NetWorker",
               },
            ],
            category: "vendor",
            name: "Dell",
         },
         {
            branches: [
               {
                  category: "product_name",
                  name: "EMC Avamar",
                  product: {
                     name: "EMC Avamar",
                     product_id: "T014381",
                     product_identification_helper: {
                        cpe: "cpe:/a:emc:avamar:-",
                     },
                  },
               },
            ],
            category: "vendor",
            name: "EMC",
         },
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "<0.8.4",
                        product: {
                           name: "Open Source libssh <0.8.4",
                           product_id: "T012886",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "<0.7.6",
                        product: {
                           name: "Open Source libssh <0.7.6",
                           product_id: "T012887",
                        },
                     },
                  ],
                  category: "product_name",
                  name: "libssh",
               },
            ],
            category: "vendor",
            name: "Open Source",
         },
         {
            branches: [
               {
                  category: "product_name",
                  name: "Ubuntu Linux",
                  product: {
                     name: "Ubuntu Linux",
                     product_id: "T000126",
                     product_identification_helper: {
                        cpe: "cpe:/o:canonical:ubuntu_linux:-",
                     },
                  },
               },
            ],
            category: "vendor",
            name: "Ubuntu",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2018-10933",
         notes: [
            {
               category: "description",
               text: "Es existiert eine Schwachstelle in libssh. Ein entfernter anonymer Angreifer kann durch das Senden speziell bearbeiteter Nachrichten die Authentisierung umgehen und sich so ohne Zugangsdaten erfolgreich authentifizieren.",
            },
         ],
         product_status: {
            known_affected: [
               "T014381",
               "2951",
               "T000126",
               "T034583",
            ],
         },
         release_date: "2018-10-16T22:00:00.000+00:00",
         title: "CVE-2018-10933",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for libssh",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for libssh fixes the following issues:\n\n- CVE-2018-10933: Fixed a server mode authentication bypass (bsc#1108020).\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-SLE-Module-Basesystem-15-2018-2244",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_3162-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2018:3162-1",
            url: "https://www.suse.com/support/update/announcement/2018/suse-su-20183162-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2018:3162-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2018-October/004676.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1108020",
            url: "https://bugzilla.suse.com/1108020",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-10933 page",
            url: "https://www.suse.com/security/cve/CVE-2018-10933/",
         },
      ],
      title: "Security update for libssh",
      tracking: {
         current_release_date: "2018-10-16T12:06:33Z",
         generator: {
            date: "2018-10-16T12:06:33Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2018:3162-1",
         initial_release_date: "2018-10-16T12:06:33Z",
         revision_history: [
            {
               date: "2018-10-16T12:06:33Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libssh-devel-0.7.5-6.3.1.aarch64",
                        product: {
                           name: "libssh-devel-0.7.5-6.3.1.aarch64",
                           product_id: "libssh-devel-0.7.5-6.3.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh4-0.7.5-6.3.1.aarch64",
                        product: {
                           name: "libssh4-0.7.5-6.3.1.aarch64",
                           product_id: "libssh4-0.7.5-6.3.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libssh-devel-0.7.5-6.3.1.ppc64le",
                        product: {
                           name: "libssh-devel-0.7.5-6.3.1.ppc64le",
                           product_id: "libssh-devel-0.7.5-6.3.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh4-0.7.5-6.3.1.ppc64le",
                        product: {
                           name: "libssh4-0.7.5-6.3.1.ppc64le",
                           product_id: "libssh4-0.7.5-6.3.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libssh-devel-0.7.5-6.3.1.s390x",
                        product: {
                           name: "libssh-devel-0.7.5-6.3.1.s390x",
                           product_id: "libssh-devel-0.7.5-6.3.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh4-0.7.5-6.3.1.s390x",
                        product: {
                           name: "libssh4-0.7.5-6.3.1.s390x",
                           product_id: "libssh4-0.7.5-6.3.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libssh-devel-0.7.5-6.3.1.x86_64",
                        product: {
                           name: "libssh-devel-0.7.5-6.3.1.x86_64",
                           product_id: "libssh-devel-0.7.5-6.3.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh4-0.7.5-6.3.1.x86_64",
                        product: {
                           name: "libssh4-0.7.5-6.3.1.x86_64",
                           product_id: "libssh4-0.7.5-6.3.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh4-32bit-0.7.5-6.3.1.x86_64",
                        product: {
                           name: "libssh4-32bit-0.7.5-6.3.1.x86_64",
                           product_id: "libssh4-32bit-0.7.5-6.3.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Module for Basesystem 15",
                        product: {
                           name: "SUSE Linux Enterprise Module for Basesystem 15",
                           product_id: "SUSE Linux Enterprise Module for Basesystem 15",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-module-basesystem:15",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-devel-0.7.5-6.3.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.aarch64",
            },
            product_reference: "libssh-devel-0.7.5-6.3.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-devel-0.7.5-6.3.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.ppc64le",
            },
            product_reference: "libssh-devel-0.7.5-6.3.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-devel-0.7.5-6.3.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.s390x",
            },
            product_reference: "libssh-devel-0.7.5-6.3.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-devel-0.7.5-6.3.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.x86_64",
            },
            product_reference: "libssh-devel-0.7.5-6.3.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.7.5-6.3.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.aarch64",
            },
            product_reference: "libssh4-0.7.5-6.3.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.7.5-6.3.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.ppc64le",
            },
            product_reference: "libssh4-0.7.5-6.3.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.7.5-6.3.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.s390x",
            },
            product_reference: "libssh4-0.7.5-6.3.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.7.5-6.3.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.x86_64",
            },
            product_reference: "libssh4-0.7.5-6.3.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-32bit-0.7.5-6.3.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15:libssh4-32bit-0.7.5-6.3.1.x86_64",
            },
            product_reference: "libssh4-32bit-0.7.5-6.3.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2018-10933",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-10933",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.aarch64",
               "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.s390x",
               "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.x86_64",
               "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.aarch64",
               "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.ppc64le",
               "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.s390x",
               "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.x86_64",
               "SUSE Linux Enterprise Module for Basesystem 15:libssh4-32bit-0.7.5-6.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-10933",
               url: "https://www.suse.com/security/cve/CVE-2018-10933",
            },
            {
               category: "external",
               summary: "SUSE Bug 1108020 for CVE-2018-10933",
               url: "https://bugzilla.suse.com/1108020",
            },
            {
               category: "external",
               summary: "SUSE Bug 1122198 for CVE-2018-10933",
               url: "https://bugzilla.suse.com/1122198",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh4-32bit-0.7.5-6.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh-devel-0.7.5-6.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh4-0.7.5-6.3.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15:libssh4-32bit-0.7.5-6.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2018-10-16T12:06:33Z",
               details: "critical",
            },
         ],
         title: "CVE-2018-10933",
      },
   ],
}