Action not permitted
Modal body text goes here.
cve-2019-1547
Vulnerability from cvelistv5
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2019-1547", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-07-19T19:04:18.544630Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-19T19:04:25.516Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-04T18:20:28.292Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "20190912 [slackware-security] openssl (SSA:2019-254-03)", "tags": [ "mailing-list", "x_transferred" ], "url": "https://seclists.org/bugtraq/2019/Sep/25" }, { "name": "openSUSE-SU-2019:2158", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html" }, { "name": "FEDORA-2019-d15aac6c4e", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/" }, { "name": "openSUSE-SU-2019:2189", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html" }, { "name": "[debian-lts-announce] 20190925 [SECURITY] [DLA 1932-1] openssl security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html" }, { "name": "FEDORA-2019-d51641f152", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/" }, { "name": "20191001 [SECURITY] [DSA 4539-1] openssl security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://seclists.org/bugtraq/2019/Oct/1" }, { "name": "20191001 [SECURITY] [DSA 4540-1] openssl1.0 security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://seclists.org/bugtraq/2019/Oct/0" }, { "name": "DSA-4539", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://www.debian.org/security/2019/dsa-4539" }, { "name": "DSA-4540", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://www.debian.org/security/2019/dsa-4540" }, { "name": "openSUSE-SU-2019:2268", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html" }, { "name": "openSUSE-SU-2019:2269", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html" }, { "name": "GLSA-201911-04", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://security.gentoo.org/glsa/201911-04" }, { "name": "USN-4376-1", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://usn.ubuntu.com/4376-1/" }, { "tags": [ "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "tags": [ "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpujul2020.html" }, { "tags": [ "x_transferred" ], "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html" }, { "tags": [ "x_transferred" ], "url": "https://www.tenable.com/security/tns-2019-08" }, { "tags": [ "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpujan2020.html" }, { "tags": [ "x_transferred" ], "url": "https://www.openssl.org/news/secadv/20190910.txt" }, { "tags": [ "x_transferred" ], "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=30c22fa8b1d840036b8e203585738df62a03cec8" }, { "tags": [ "x_transferred" ], "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7c1709c2da5414f5b6133d00a03fc8c5bf996c7a" }, { "tags": [ "x_transferred" ], "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=21c856b75d81eff61aa63b4f036bb64a85bf6d46" }, { "tags": [ "x_transferred" ], "url": "https://arxiv.org/abs/1909.01785" }, { "tags": [ "x_transferred" ], "url": "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20190919-0002/" }, { "tags": [ "x_transferred" ], "url": "https://support.f5.com/csp/article/K73422160?utm_source=f5support\u0026amp%3Butm_medium=RSS" }, { "tags": [ "x_transferred" ], "url": "https://www.tenable.com/security/tns-2019-09" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20200122-0002/" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20200416-0003/" }, { "name": "USN-4376-2", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://usn.ubuntu.com/4376-2/" }, { "name": "USN-4504-1", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://usn.ubuntu.com/4504-1/" }, { "tags": [ "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpuoct2020.html" }, { "tags": [ "x_transferred" ], "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20240621-0006/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "OpenSSL", "vendor": "OpenSSL", "versions": [ { "status": "affected", "version": "Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c)" }, { "status": "affected", "version": "Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k)" }, { "status": "affected", "version": "Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s)" } ] } ], "credits": [ { "lang": "en", "value": "Cesar Pereida Garc\u00eda, Sohaib ul Hassan, Nicola Tuveri, Iaroslav Gridin, Alejandro Cabrera Aldaya, and Billy Brumley" } ], "datePublic": "2019-09-10T00:00:00", "descriptions": [ { "lang": "en", "value": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s)." } ], "metrics": [ { "other": { "content": { "lang": "eng", "url": "https://www.openssl.org/policies/secpolicy.html#Low", "value": "Low" }, "type": "unknown" } } ], "problemTypes": [ { "descriptions": [ { "description": "Timing side channel", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2024-06-21T19:06:30.909094", "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl" }, "references": [ { "name": "20190912 [slackware-security] openssl (SSA:2019-254-03)", "tags": [ "mailing-list" ], "url": "https://seclists.org/bugtraq/2019/Sep/25" }, { "name": "openSUSE-SU-2019:2158", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html" }, { "name": "FEDORA-2019-d15aac6c4e", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/" }, { "name": "openSUSE-SU-2019:2189", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html" }, { "name": "[debian-lts-announce] 20190925 [SECURITY] [DLA 1932-1] openssl security update", "tags": [ "mailing-list" ], "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html" }, { "name": "FEDORA-2019-d51641f152", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/" }, { "name": "20191001 [SECURITY] [DSA 4539-1] openssl security update", "tags": [ "mailing-list" ], "url": "https://seclists.org/bugtraq/2019/Oct/1" }, { "name": "20191001 [SECURITY] [DSA 4540-1] openssl1.0 security update", "tags": [ "mailing-list" ], "url": "https://seclists.org/bugtraq/2019/Oct/0" }, { "name": "DSA-4539", "tags": [ "vendor-advisory" ], "url": "https://www.debian.org/security/2019/dsa-4539" }, { "name": "DSA-4540", "tags": [ "vendor-advisory" ], "url": "https://www.debian.org/security/2019/dsa-4540" }, { "name": "openSUSE-SU-2019:2268", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html" }, { "name": "openSUSE-SU-2019:2269", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html" }, { "name": "GLSA-201911-04", "tags": [ "vendor-advisory" ], "url": "https://security.gentoo.org/glsa/201911-04" }, { "name": "USN-4376-1", "tags": [ "vendor-advisory" ], "url": "https://usn.ubuntu.com/4376-1/" }, { "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "url": "https://www.oracle.com/security-alerts/cpujul2020.html" }, { "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html" }, { "url": "https://www.tenable.com/security/tns-2019-08" }, { "url": "https://www.oracle.com/security-alerts/cpujan2020.html" }, { "url": "https://www.openssl.org/news/secadv/20190910.txt" }, { "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=30c22fa8b1d840036b8e203585738df62a03cec8" }, { "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7c1709c2da5414f5b6133d00a03fc8c5bf996c7a" }, { "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=21c856b75d81eff61aa63b4f036bb64a85bf6d46" }, { "url": "https://arxiv.org/abs/1909.01785" }, { "url": "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html" }, { "url": "https://security.netapp.com/advisory/ntap-20190919-0002/" }, { "url": "https://support.f5.com/csp/article/K73422160?utm_source=f5support\u0026amp%3Butm_medium=RSS" }, { "url": "https://www.tenable.com/security/tns-2019-09" }, { "url": "https://security.netapp.com/advisory/ntap-20200122-0002/" }, { "url": "https://security.netapp.com/advisory/ntap-20200416-0003/" }, { "name": "USN-4376-2", "tags": [ "vendor-advisory" ], "url": "https://usn.ubuntu.com/4376-2/" }, { "name": "USN-4504-1", "tags": [ "vendor-advisory" ], "url": "https://usn.ubuntu.com/4504-1/" }, { "url": "https://www.oracle.com/security-alerts/cpuoct2020.html" }, { "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365" }, { "url": "https://security.netapp.com/advisory/ntap-20240621-0006/" } ], "title": "ECDSA remote timing attack" } }, "cveMetadata": { "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "assignerShortName": "openssl", "cveId": "CVE-2019-1547", "datePublished": "2019-09-10T16:58:35.307121Z", "dateReserved": "2018-11-28T00:00:00", "dateUpdated": "2024-09-16T16:33:05.874Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2019-1547\",\"sourceIdentifier\":\"openssl-security@openssl.org\",\"published\":\"2019-09-10T17:15:11.750\",\"lastModified\":\"2024-06-21T19:15:15.567\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).\"},{\"lang\":\"es\",\"value\":\"Normalmente en los grupos EC de OpenSSL siempre tienen un cofactor presente y este es usado en rutas de c\u00f3digo resistentes a canales laterales. Sin embargo, en ciertos casos, es posible construir un grupo usando par\u00e1metros expl\u00edcitos (en lugar de usar una curva nombrada). En esos casos, es posible que dicho grupo no tenga el cofactor presente. Esto puede ocurrir incluso cuando todos los par\u00e1metros coinciden con una curva de nombre conocido. Si es utilizada dicha curva, entonces OpenSSL recurre a rutas de c\u00f3digo resistentes a canales no laterales lo que puede resultar en una recuperaci\u00f3n de clave completa durante una operaci\u00f3n de firma ECDSA. Para que sea vulnerable, un atacante tendr\u00eda que tener la capacidad de cronometrar la creaci\u00f3n de un gran n\u00famero de firmas donde par\u00e1metros expl\u00edcitos sin cofactor presente est\u00e1n en uso mediante una aplicaci\u00f3n que utiliza libcrypto. Para evitar dudas, libssl no es vulnerable porque nunca se utilizan par\u00e1metros expl\u00edcitos. Corregido en OpenSSL versi\u00f3n 1.1.1d (afectada la versi\u00f3n 1.1.1-1.1.1c). Corregido en OpenSSL versi\u00f3n 1.1.0l (afectada la versi\u00f3n 1.1.0-1.1.0k). Corregida en OpenSSL versi\u00f3n 1.0.2t (afectada la versi\u00f3n 1.0.2-1.0.2s).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:M/Au:N/C:P/I:N/A:N\",\"accessVector\":\"LOCAL\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":1.9},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.4,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.0.2\",\"versionEndIncluding\":\"1.0.2s\",\"matchCriteriaId\":\"0DAC8B94-3674-4E4B-9BB0-A16CA0197885\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.1.0\",\"versionEndIncluding\":\"1.1.0k\",\"matchCriteriaId\":\"65728FC6-4B4F-4D43-872B-BE1133BB2281\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.1.1\",\"versionEndIncluding\":\"1.1.1c\",\"matchCriteriaId\":\"A2ACA227-3992-478E-85C3-023D8AF88A08\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://arxiv.org/abs/1909.01785\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=21c856b75d81eff61aa63b4f036bb64a85bf6d46\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=30c22fa8b1d840036b8e203585738df62a03cec8\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7c1709c2da5414f5b6133d00a03fc8c5bf996c7a\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://seclists.org/bugtraq/2019/Oct/0\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://seclists.org/bugtraq/2019/Oct/1\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://seclists.org/bugtraq/2019/Sep/25\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/201911-04\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20190919-0002/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20200122-0002/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20200416-0003/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20240621-0006/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://support.f5.com/csp/article/K73422160?utm_source=f5support\u0026amp%3Butm_medium=RSS\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://usn.ubuntu.com/4376-1/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://usn.ubuntu.com/4376-2/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://usn.ubuntu.com/4504-1/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://www.debian.org/security/2019/dsa-4539\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://www.debian.org/security/2019/dsa-4540\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://www.openssl.org/news/secadv/20190910.txt\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2020.html\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2020.html\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2020.html\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2020.html\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://www.tenable.com/security/tns-2019-08\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://www.tenable.com/security/tns-2019-09\",\"source\":\"openssl-security@openssl.org\"}]}}" } }
rhsa-2020_1840
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for openssl is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: side-channel weak encryption vulnerability (CVE-2019-1547)\n\n* openssl: information disclosure in fork() (CVE-2019-1549)\n\n* openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey (CVE-2019-1563)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:1840", "url": "https://access.redhat.com/errata/RHSA-2020:1840" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index" }, { "category": "external", "summary": "1735738", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735738" }, { "category": "external", "summary": "1741285", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741285" }, { "category": "external", "summary": "1741317", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741317" }, { "category": "external", "summary": "1741641", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741641" }, { "category": "external", "summary": "1749068", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1749068" }, { "category": "external", "summary": "1749790", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1749790" }, { "category": "external", "summary": "1752090", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752090" }, { "category": "external", "summary": "1752095", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752095" }, { "category": "external", "summary": "1752100", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752100" }, { "category": "external", "summary": "1758587", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1758587" }, { "category": "external", "summary": "1793984", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1793984" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1840.json" } ], "title": "Red Hat Security Advisory: openssl security and bug fix update", "tracking": { "current_release_date": "2024-11-05T22:09:30+00:00", "generator": { "date": "2024-11-05T22:09:30+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2020:1840", "initial_release_date": "2020-04-28T15:52:32+00:00", "revision_history": [ { "date": "2020-04-28T15:52:32+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-04-28T15:52:32+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T22:09:30+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux BaseOS (v. 8)", "product": { "name": "Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:8::baseos" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "openssl-1:1.1.1c-15.el8.ppc64le", "product": { "name": "openssl-1:1.1.1c-15.el8.ppc64le", "product_id": "openssl-1:1.1.1c-15.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-15.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-15.el8.ppc64le", "product": { "name": "openssl-devel-1:1.1.1c-15.el8.ppc64le", "product_id": "openssl-devel-1:1.1.1c-15.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-15.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.1.1c-15.el8.ppc64le", "product": { "name": "openssl-libs-1:1.1.1c-15.el8.ppc64le", "product_id": "openssl-libs-1:1.1.1c-15.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-15.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-15.el8.ppc64le", "product": { "name": "openssl-perl-1:1.1.1c-15.el8.ppc64le", "product_id": "openssl-perl-1:1.1.1c-15.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-15.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-15.el8.ppc64le", "product": { "name": "openssl-debugsource-1:1.1.1c-15.el8.ppc64le", "product_id": "openssl-debugsource-1:1.1.1c-15.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-15.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-15.el8.ppc64le", "product": { "name": "openssl-debuginfo-1:1.1.1c-15.el8.ppc64le", "product_id": "openssl-debuginfo-1:1.1.1c-15.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-15.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le", "product_id": "openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-15.el8?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "openssl-1:1.1.1c-15.el8.s390x", "product": { "name": "openssl-1:1.1.1c-15.el8.s390x", "product_id": "openssl-1:1.1.1c-15.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-15.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-15.el8.s390x", "product": { "name": "openssl-devel-1:1.1.1c-15.el8.s390x", "product_id": "openssl-devel-1:1.1.1c-15.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-15.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.1.1c-15.el8.s390x", "product": { "name": "openssl-libs-1:1.1.1c-15.el8.s390x", "product_id": "openssl-libs-1:1.1.1c-15.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-15.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-15.el8.s390x", "product": { "name": "openssl-perl-1:1.1.1c-15.el8.s390x", "product_id": "openssl-perl-1:1.1.1c-15.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-15.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-15.el8.s390x", "product": { "name": "openssl-debugsource-1:1.1.1c-15.el8.s390x", "product_id": "openssl-debugsource-1:1.1.1c-15.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-15.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-15.el8.s390x", "product": { "name": "openssl-debuginfo-1:1.1.1c-15.el8.s390x", "product_id": "openssl-debuginfo-1:1.1.1c-15.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-15.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x", "product_id": "openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-15.el8?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "openssl-1:1.1.1c-15.el8.x86_64", "product": { "name": "openssl-1:1.1.1c-15.el8.x86_64", "product_id": "openssl-1:1.1.1c-15.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-15.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-15.el8.x86_64", "product": { "name": "openssl-devel-1:1.1.1c-15.el8.x86_64", "product_id": "openssl-devel-1:1.1.1c-15.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-15.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.1.1c-15.el8.x86_64", "product": { "name": "openssl-libs-1:1.1.1c-15.el8.x86_64", "product_id": "openssl-libs-1:1.1.1c-15.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-15.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-15.el8.x86_64", "product": { "name": "openssl-perl-1:1.1.1c-15.el8.x86_64", "product_id": "openssl-perl-1:1.1.1c-15.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-15.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-15.el8.x86_64", "product": { "name": "openssl-debugsource-1:1.1.1c-15.el8.x86_64", "product_id": "openssl-debugsource-1:1.1.1c-15.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-15.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-15.el8.x86_64", "product": { "name": "openssl-debuginfo-1:1.1.1c-15.el8.x86_64", "product_id": "openssl-debuginfo-1:1.1.1c-15.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-15.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64", "product_id": "openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-15.el8?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "openssl-devel-1:1.1.1c-15.el8.i686", "product": { "name": "openssl-devel-1:1.1.1c-15.el8.i686", "product_id": "openssl-devel-1:1.1.1c-15.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-15.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.1.1c-15.el8.i686", "product": { "name": "openssl-libs-1:1.1.1c-15.el8.i686", "product_id": "openssl-libs-1:1.1.1c-15.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-15.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-15.el8.i686", "product": { "name": "openssl-debugsource-1:1.1.1c-15.el8.i686", "product_id": "openssl-debugsource-1:1.1.1c-15.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-15.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-15.el8.i686", "product": { "name": "openssl-debuginfo-1:1.1.1c-15.el8.i686", "product_id": "openssl-debuginfo-1:1.1.1c-15.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-15.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-15.el8.i686", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-15.el8.i686", "product_id": "openssl-libs-debuginfo-1:1.1.1c-15.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-15.el8?arch=i686\u0026epoch=1" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "openssl-1:1.1.1c-15.el8.aarch64", "product": { "name": "openssl-1:1.1.1c-15.el8.aarch64", "product_id": "openssl-1:1.1.1c-15.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-15.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-15.el8.aarch64", "product": { "name": "openssl-devel-1:1.1.1c-15.el8.aarch64", "product_id": "openssl-devel-1:1.1.1c-15.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-15.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.1.1c-15.el8.aarch64", "product": { "name": "openssl-libs-1:1.1.1c-15.el8.aarch64", "product_id": "openssl-libs-1:1.1.1c-15.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-15.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-15.el8.aarch64", "product": { "name": "openssl-perl-1:1.1.1c-15.el8.aarch64", "product_id": "openssl-perl-1:1.1.1c-15.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-15.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-15.el8.aarch64", "product": { "name": "openssl-debugsource-1:1.1.1c-15.el8.aarch64", "product_id": "openssl-debugsource-1:1.1.1c-15.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-15.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-15.el8.aarch64", "product": { "name": "openssl-debuginfo-1:1.1.1c-15.el8.aarch64", "product_id": "openssl-debuginfo-1:1.1.1c-15.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-15.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64", "product_id": "openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-15.el8?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "openssl-1:1.1.1c-15.el8.src", "product": { "name": "openssl-1:1.1.1c-15.el8.src", "product_id": "openssl-1:1.1.1c-15.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-15.el8?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-15.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.aarch64" }, "product_reference": "openssl-1:1.1.1c-15.el8.aarch64", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-15.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.ppc64le" }, "product_reference": "openssl-1:1.1.1c-15.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-15.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.s390x" }, "product_reference": "openssl-1:1.1.1c-15.el8.s390x", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-15.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.src" }, "product_reference": "openssl-1:1.1.1c-15.el8.src", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-15.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.x86_64" }, "product_reference": "openssl-1:1.1.1c-15.el8.x86_64", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-15.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.aarch64" }, "product_reference": "openssl-debuginfo-1:1.1.1c-15.el8.aarch64", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-15.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.i686" }, "product_reference": "openssl-debuginfo-1:1.1.1c-15.el8.i686", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-15.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.1.1c-15.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-15.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.s390x" }, "product_reference": "openssl-debuginfo-1:1.1.1c-15.el8.s390x", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-15.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.x86_64" }, "product_reference": "openssl-debuginfo-1:1.1.1c-15.el8.x86_64", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-15.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.aarch64" }, "product_reference": "openssl-debugsource-1:1.1.1c-15.el8.aarch64", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-15.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.i686" }, "product_reference": "openssl-debugsource-1:1.1.1c-15.el8.i686", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-15.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.ppc64le" }, "product_reference": "openssl-debugsource-1:1.1.1c-15.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-15.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.s390x" }, "product_reference": "openssl-debugsource-1:1.1.1c-15.el8.s390x", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-15.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.x86_64" }, "product_reference": "openssl-debugsource-1:1.1.1c-15.el8.x86_64", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-15.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.aarch64" }, "product_reference": "openssl-devel-1:1.1.1c-15.el8.aarch64", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-15.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.i686" }, "product_reference": "openssl-devel-1:1.1.1c-15.el8.i686", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-15.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.ppc64le" }, "product_reference": "openssl-devel-1:1.1.1c-15.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-15.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.s390x" }, "product_reference": "openssl-devel-1:1.1.1c-15.el8.s390x", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-15.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.x86_64" }, "product_reference": "openssl-devel-1:1.1.1c-15.el8.x86_64", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-15.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.aarch64" }, "product_reference": "openssl-libs-1:1.1.1c-15.el8.aarch64", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-15.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.i686" }, "product_reference": "openssl-libs-1:1.1.1c-15.el8.i686", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-15.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.ppc64le" }, "product_reference": "openssl-libs-1:1.1.1c-15.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-15.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.s390x" }, "product_reference": "openssl-libs-1:1.1.1c-15.el8.s390x", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-15.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.x86_64" }, "product_reference": "openssl-libs-1:1.1.1c-15.el8.x86_64", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-15.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.i686" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-15.el8.i686", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-15.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.aarch64" }, "product_reference": "openssl-perl-1:1.1.1c-15.el8.aarch64", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-15.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.ppc64le" }, "product_reference": "openssl-perl-1:1.1.1c-15.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-15.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.s390x" }, "product_reference": "openssl-perl-1:1.1.1c-15.el8.s390x", "relates_to_product_reference": "BaseOS-8.2.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-15.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.x86_64" }, "product_reference": "openssl-perl-1:1.1.1c-15.el8.x86_64", "relates_to_product_reference": "BaseOS-8.2.0.GA" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-1547", "cwe": { "id": "CWE-602", "name": "Client-Side Enforcement of Server-Side Security" }, "discovery_date": "2019-09-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1752090" } ], "notes": [ { "category": "description", "text": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: side-channel weak encryption vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "As per upstream: In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. Also libssl is not vulnerable because explicit parameters are never used.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.src", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1547" }, { "category": "external", "summary": "RHBZ#1752090", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752090" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1547", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1547" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1547", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1547" } ], "release_date": "2019-09-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-28T15:52:32+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.src", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1840" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.src", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: side-channel weak encryption vulnerability" }, { "cve": "CVE-2019-1549", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2019-09-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1752095" } ], "notes": [ { "category": "description", "text": "OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: information disclosure in fork()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.src", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1549" }, { "category": "external", "summary": "RHBZ#1752095", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752095" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1549", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1549" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1549", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1549" } ], "release_date": "2019-09-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-28T15:52:32+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.src", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1840" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.src", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: information disclosure in fork()" }, { "cve": "CVE-2019-1563", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2019-09-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1752100" } ], "notes": [ { "category": "description", "text": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.src", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1563" }, { "category": "external", "summary": "RHBZ#1752100", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752100" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1563", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1563" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1563", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1563" } ], "release_date": "2019-09-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-28T15:52:32+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.src", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1840" }, { "category": "workaround", "details": "This attack is carried out by sending a large number of messages to be decrypted by the victim. The attacker needs to receive a response from the victim if the decryption was successful or not. Therefore only if the user application compiled with openssl is designed above way, the attack will be viable.\nOnly CMS_decrypt and PKCS7_decrypt functions are affected. Applications compiled with openssl are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt.", "product_ids": [ "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.src", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.src", "BaseOS-8.2.0.GA:openssl-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-debugsource-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-devel-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.i686", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-libs-debuginfo-1:1.1.1c-15.el8.x86_64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.aarch64", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.ppc64le", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.s390x", "BaseOS-8.2.0.GA:openssl-perl-1:1.1.1c-15.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey" } ] }
rhsa-2020_1336
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 2 zip release for RHEL 6, RHEL 7 and Microsoft Windows is available.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.\n\nThis release adds the new Apache HTTP Server 2.4.37 Service Pack 2 packages that are part of the JBoss Core Services offering.\n\nThis release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 1 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* openssl: side-channel weak encryption vulnerability (CVE-2019-1547)\n\n* httpd: memory corruption on early pushes (CVE-2019-10081)\n\n* httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)\n\n* httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)\n\n* openssl: information disclosure in fork() (CVE-2019-1549)\n\n* openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey (CVE-2019-1563)\n\n* httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)\n\n* httpd: mod_rewrite potential open redirect (CVE-2019-10098)\n\n* httpd: mod_rewrite configurations vulnerable to open redirect(CVE-2020-1927)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:1336", "url": "https://access.redhat.com/errata/RHSA-2020:1336" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.apachehttp\u0026downloadType=securityPatches\u0026version=2.4.37", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.apachehttp\u0026downloadType=securityPatches\u0026version=2.4.37" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.openssl\u0026downloadType=securityPatches\u0026version=1.1.1c", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.openssl\u0026downloadType=securityPatches\u0026version=1.1.1c" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/" }, { "category": "external", "summary": "1743956", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743956" }, { "category": "external", "summary": "1743959", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743959" }, { "category": "external", "summary": "1743966", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743966" }, { "category": "external", "summary": "1743974", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743974" }, { "category": "external", "summary": "1743996", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743996" }, { "category": "external", "summary": "1752090", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752090" }, { "category": "external", "summary": "1752095", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752095" }, { "category": "external", "summary": "1752100", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752100" }, { "category": "external", "summary": "1820761", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1820761" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1336.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 security update", "tracking": { "current_release_date": "2024-11-15T06:10:19+00:00", "generator": { "date": "2024-11-15T06:10:19+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:1336", "initial_release_date": "2020-04-06T19:09:57+00:00", "revision_history": [ { "date": "2020-04-06T19:09:57+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-04-22T14:04:39+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T06:10:19+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "JBoss Core Services Apache HTTP Server 2.4.37 SP2", "product": { "name": "JBoss Core Services Apache HTTP Server 2.4.37 SP2", "product_id": "JBoss Core Services Apache HTTP Server 2.4.37 SP2", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_core_services:1" } } } ], "category": "product_family", "name": "Red Hat JBoss Core Services" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-1547", "cwe": { "id": "CWE-602", "name": "Client-Side Enforcement of Server-Side Security" }, "discovery_date": "2019-09-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1752090" } ], "notes": [ { "category": "description", "text": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: side-channel weak encryption vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "As per upstream: In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. Also libssl is not vulnerable because explicit parameters are never used.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1547" }, { "category": "external", "summary": "RHBZ#1752090", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752090" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1547", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1547" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1547", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1547" } ], "release_date": "2019-09-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:09:57+00:00", "details": "The References section of this erratum contains a download link (you must log in to download the update).\n\nBefore applying the update, back up your existing Red Hat JBoss Core Services installation (including all applications and configuration files).", "product_ids": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1336" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: side-channel weak encryption vulnerability" }, { "cve": "CVE-2019-1549", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2019-09-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1752095" } ], "notes": [ { "category": "description", "text": "OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: information disclosure in fork()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1549" }, { "category": "external", "summary": "RHBZ#1752095", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752095" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1549", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1549" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1549", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1549" } ], "release_date": "2019-09-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:09:57+00:00", "details": "The References section of this erratum contains a download link (you must log in to download the update).\n\nBefore applying the update, back up your existing Red Hat JBoss Core Services installation (including all applications and configuration files).", "product_ids": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1336" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: information disclosure in fork()" }, { "cve": "CVE-2019-1563", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2019-09-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1752100" } ], "notes": [ { "category": "description", "text": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1563" }, { "category": "external", "summary": "RHBZ#1752100", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752100" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1563", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1563" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1563", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1563" } ], "release_date": "2019-09-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:09:57+00:00", "details": "The References section of this erratum contains a download link (you must log in to download the update).\n\nBefore applying the update, back up your existing Red Hat JBoss Core Services installation (including all applications and configuration files).", "product_ids": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1336" }, { "category": "workaround", "details": "This attack is carried out by sending a large number of messages to be decrypted by the victim. The attacker needs to receive a response from the victim if the decryption was successful or not. Therefore only if the user application compiled with openssl is designed above way, the attack will be viable.\nOnly CMS_decrypt and PKCS7_decrypt functions are affected. Applications compiled with openssl are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt.", "product_ids": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey" }, { "cve": "CVE-2019-10081", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1743966" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache httpd, in mod_http2. Under certain circumstances, HTTP/2 early pushes could lead to memory corruption, causing a server to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: memory corruption on early pushes", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10081" }, { "category": "external", "summary": "RHBZ#1743966", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743966" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10081", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10081" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10081", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10081" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-08-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:09:57+00:00", "details": "The References section of this erratum contains a download link (you must log in to download the update).\n\nBefore applying the update, back up your existing Red Hat JBoss Core Services installation (including all applications and configuration files).", "product_ids": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1336" }, { "category": "workaround", "details": "This flaw is only exploitable if Apache httpd is configured to respond to HTTP/2 requests, which is done by including \"h2\" or \"h2c\" in the \"Protocols\" list in a configuration file. The following command can be used to search for possible vulnerable configurations: \n\n grep -R \u0027^\\s*Protocols\\\u003e.*\\\u003ch2\\\u003e\u0027 /etc/httpd/\n\nSee https://httpd.apache.org/docs/2.4/mod/mod_http2.html", "product_ids": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: memory corruption on early pushes" }, { "cve": "CVE-2019-10082", "discovery_date": "2019-08-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1743974" } ], "notes": [ { "category": "description", "text": "A read-after-free vulnerability was discovered in Apache httpd, in mod_http2. A specially crafted http/2 client session could cause the server to read memory that was previously freed during connection shutdown, potentially leading to a crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: read-after-free in h2 connection shutdown", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10082" }, { "category": "external", "summary": "RHBZ#1743974", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743974" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10082", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10082" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10082", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10082" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-08-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:09:57+00:00", "details": "The References section of this erratum contains a download link (you must log in to download the update).\n\nBefore applying the update, back up your existing Red Hat JBoss Core Services installation (including all applications and configuration files).", "product_ids": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1336" }, { "category": "workaround", "details": "This flaw is only exploitable if Apache httpd is configured to respond to HTTP/2 requests, which is done by including \"h2\" or \"h2c\" in the \"Protocols\" list in a configuration file. The following command can be used to search for possible vulnerable configurations: \n\n grep -R \u0027^\\s*Protocols\\\u003e.*\\\u003ch2\\\u003e\u0027 /etc/httpd/\n\nSee https://httpd.apache.org/docs/2.4/mod/mod_http2.html", "product_ids": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: read-after-free in h2 connection shutdown" }, { "cve": "CVE-2019-10092", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-08-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1743956" } ], "notes": [ { "category": "description", "text": "A cross-site scripting vulnerability was found in Apache httpd, affecting the mod_proxy error page. Under certain circumstances, a crafted link could inject content into the HTML displayed in the error page, potentially leading to client-side exploitation.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: limited cross-site scripting in mod_proxy error page", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10092" }, { "category": "external", "summary": "RHBZ#1743956", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743956" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10092", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10092" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10092", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10092" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-08-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:09:57+00:00", "details": "The References section of this erratum contains a download link (you must log in to download the update).\n\nBefore applying the update, back up your existing Red Hat JBoss Core Services installation (including all applications and configuration files).", "product_ids": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1336" }, { "category": "workaround", "details": "This flaw is only exploitable if Proxy* directives are used in Apache httpd configuration. The following command can be used to search for possible vulnerable configurations:\n\n grep -R \u0027^\\s*Proxy\u0027 /etc/httpd/\n\nSee https://httpd.apache.org/docs/2.4/mod/mod_proxy.html", "product_ids": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: limited cross-site scripting in mod_proxy error page" }, { "cve": "CVE-2019-10097", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-08-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1743996" } ], "notes": [ { "category": "description", "text": "A vulnerability was discovered in Apache httpd, in mod_remoteip. A trusted proxy using the \"PROXY\" protocol could send specially crafted headers that can cause httpd to experience a stack buffer overflow or NULL pointer dereference, leading to a crash or other potential consequences.\r\n\r\nThis issue could only be exploited by configured trusted intermediate proxy servers. HTTP clients such as browsers could not exploit the vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: null-pointer dereference in mod_remoteip", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10097" }, { "category": "external", "summary": "RHBZ#1743996", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743996" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10097", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10097" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10097", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10097" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-08-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:09:57+00:00", "details": "The References section of this erratum contains a download link (you must log in to download the update).\n\nBefore applying the update, back up your existing Red Hat JBoss Core Services installation (including all applications and configuration files).", "product_ids": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1336" }, { "category": "workaround", "details": "This flaw is only exploitable if RemoteIP* directives are used in Apache httpd configuration. The following command can be used to search for possible vulnerable configurations:\n\n grep -R \u0027^\\s*RemoteIP\u0027 /etc/httpd/\n\nSee https://httpd.apache.org/docs/2.4/mod/mod_remoteip.html", "product_ids": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: null-pointer dereference in mod_remoteip" }, { "cve": "CVE-2019-10098", "discovery_date": "2019-08-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1743959" } ], "notes": [ { "category": "description", "text": "A vulnerability was discovered in Apache httpd, in mod_rewrite. Certain self-referential mod_rewrite rules could be fooled by encoded newlines, causing them to redirect to an unexpected location. An attacker could abuse this flaw in a phishing attack or as part of a client-side attack on browsers.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_rewrite potential open redirect", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10098" }, { "category": "external", "summary": "RHBZ#1743959", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743959" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10098", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10098" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10098", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10098" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-08-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:09:57+00:00", "details": "The References section of this erratum contains a download link (you must log in to download the update).\n\nBefore applying the update, back up your existing Red Hat JBoss Core Services installation (including all applications and configuration files).", "product_ids": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1336" }, { "category": "workaround", "details": "This flaw requires the use of certain Rewrite configuration directives. The following command can be used to search for possible vulnerable configurations:\n\n grep -R \u0027^\\s*Rewrite\u0027 /etc/httpd/\n\nSee https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html", "product_ids": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0" }, "products": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_rewrite potential open redirect" }, { "cve": "CVE-2020-1927", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2020-04-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1820761" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache HTTP Server (httpd) versions 2.4.0 to 2.4.41. Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirected instead to an unexpected URL within the request URL.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_rewrite configurations vulnerable to open redirect", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue only affects httpd versions between 2.4.0 and 2.4.41. Therefore Red Hat Enterprise Linux 5 and 6 are not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1927" }, { "category": "external", "summary": "RHBZ#1820761", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1820761" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1927", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1927" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1927", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1927" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2020-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:09:57+00:00", "details": "The References section of this erratum contains a download link (you must log in to download the update).\n\nBefore applying the update, back up your existing Red Hat JBoss Core Services installation (including all applications and configuration files).", "product_ids": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1336" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "JBoss Core Services Apache HTTP Server 2.4.37 SP2" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_rewrite configurations vulnerable to open redirect" } ] }
rhsa-2020_1337
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "This release adds the new Apache HTTP Server 2.4.37 Service Pack 2 packages that are part of the JBoss Core Services offering.\n\nThis release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 1 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* openssl: side-channel weak encryption vulnerability (CVE-2019-1547)\n\n* httpd: memory corruption on early pushes (CVE-2019-10081)\n\n* httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)\n\n* httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)\n\n* openssl: information disclosure in fork() (CVE-2019-1549)\n\n* openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey (CVE-2019-1563)\n\n* httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)\n\n* httpd: mod_rewrite potential open redirect (CVE-2019-10098)\n\n* httpd: mod_rewrite configurations vulnerable to open redirect(CVE-2020-1927)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:1337", "url": "https://access.redhat.com/errata/RHSA-2020:1337" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/" }, { "category": "external", "summary": "1743956", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743956" }, { "category": "external", "summary": "1743959", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743959" }, { "category": "external", "summary": "1743966", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743966" }, { "category": "external", "summary": "1743974", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743974" }, { "category": "external", "summary": "1743996", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743996" }, { "category": "external", "summary": "1752090", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752090" }, { "category": "external", "summary": "1752095", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752095" }, { "category": "external", "summary": "1752100", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752100" }, { "category": "external", "summary": "1820761", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1820761" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1337.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 security update", "tracking": { "current_release_date": "2024-11-15T06:10:10+00:00", "generator": { "date": "2024-11-15T06:10:10+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:1337", "initial_release_date": "2020-04-06T19:28:23+00:00", "revision_history": [ { "date": "2020-04-06T19:28:23+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-04-22T14:10:17+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T06:10:10+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Core Services on RHEL 6 Server", "product": { "name": "Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_core_services:1::el6" } } }, { "category": "product_name", "name": "Red Hat JBoss Core Services on RHEL 7 Server", "product": { "name": "Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_core_services:1::el7" } } } ], "category": "product_family", "name": "Red Hat JBoss Core Services" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1c-16.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.1.1c-16.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.1.1c-16.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.1.1c-16.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.1.1c-16.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.1.1c-16.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-52.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.37-52.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.37-52.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.37-52.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.37-52.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.37-52.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.37-52.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.37-52.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.37-52.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-41.Final_redhat_2.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native-debuginfo@1.3.12-41.Final_redhat_2.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_http2@1.11.3-22.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_http2-debuginfo@1.11.3-22.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-86.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-devel@1.6.3-86.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-debuginfo@1.6.3-86.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "product_id": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-21.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "product_id": "jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-devel@1.0.6-21.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "product_id": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-debuginfo@1.0.6-21.jbcs.el6?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1c-16.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.1.1c-16.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.1.1c-16.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.1.1c-16.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.1.1c-16.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.1.1c-16.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-52.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.37-52.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.37-52.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.37-52.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.37-52.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.37-52.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.37-52.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.37-52.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.37-52.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-41.Final_redhat_2.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native-debuginfo@1.3.12-41.Final_redhat_2.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_http2@1.11.3-22.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_http2-debuginfo@1.11.3-22.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-86.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-devel@1.6.3-86.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-debuginfo@1.6.3-86.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-21.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-devel@1.0.6-21.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-debuginfo@1.0.6-21.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1c-16.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.1.1c-16.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.1.1c-16.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.1.1c-16.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.1.1c-16.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.1.1c-16.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-52.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.37-52.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.37-52.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.37-52.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.37-52.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.37-52.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.37-52.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.37-52.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.37-52.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-41.Final_redhat_2.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native-debuginfo@1.3.12-41.Final_redhat_2.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_http2@1.11.3-22.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_http2-debuginfo@1.11.3-22.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-86.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-devel@1.6.3-86.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-debuginfo@1.6.3-86.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-21.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-devel@1.0.6-21.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-debuginfo@1.0.6-21.jbcs.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "product_id": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1c-16.jbcs.el6?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "product_id": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-52.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-41.Final_redhat_2.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "product": { "name": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "product_id": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_http2@1.11.3-22.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "product_id": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-86.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "product_id": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-21.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "product_id": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1c-16.jbcs.el7?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "product_id": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-52.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-41.Final_redhat_2.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "product": { "name": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "product_id": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_http2@1.11.3-22.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "product_id": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-86.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "product_id": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-21.jbcs.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "product": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "product_id": "jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-manual@2.4.37-52.jbcs.el6?arch=noarch" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "product": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "product_id": "jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-manual@2.4.37-52.jbcs.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch" }, "product_reference": "jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch" }, "product_reference": "jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-1547", "cwe": { "id": "CWE-602", "name": "Client-Side Enforcement of Server-Side Security" }, "discovery_date": "2019-09-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1752090" } ], "notes": [ { "category": "description", "text": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: side-channel weak encryption vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "As per upstream: In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. Also libssl is not vulnerable because explicit parameters are never used.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1547" }, { "category": "external", "summary": "RHBZ#1752090", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752090" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1547", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1547" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1547", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1547" } ], "release_date": "2019-09-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:28:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1337" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: side-channel weak encryption vulnerability" }, { "cve": "CVE-2019-1549", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2019-09-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1752095" } ], "notes": [ { "category": "description", "text": "OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: information disclosure in fork()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1549" }, { "category": "external", "summary": "RHBZ#1752095", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752095" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1549", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1549" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1549", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1549" } ], "release_date": "2019-09-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:28:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1337" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: information disclosure in fork()" }, { "cve": "CVE-2019-1563", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2019-09-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1752100" } ], "notes": [ { "category": "description", "text": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1563" }, { "category": "external", "summary": "RHBZ#1752100", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752100" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1563", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1563" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1563", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1563" } ], "release_date": "2019-09-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:28:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1337" }, { "category": "workaround", "details": "This attack is carried out by sending a large number of messages to be decrypted by the victim. The attacker needs to receive a response from the victim if the decryption was successful or not. Therefore only if the user application compiled with openssl is designed above way, the attack will be viable.\nOnly CMS_decrypt and PKCS7_decrypt functions are affected. Applications compiled with openssl are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey" }, { "cve": "CVE-2019-10081", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1743966" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache httpd, in mod_http2. Under certain circumstances, HTTP/2 early pushes could lead to memory corruption, causing a server to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: memory corruption on early pushes", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10081" }, { "category": "external", "summary": "RHBZ#1743966", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743966" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10081", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10081" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10081", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10081" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-08-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:28:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1337" }, { "category": "workaround", "details": "This flaw is only exploitable if Apache httpd is configured to respond to HTTP/2 requests, which is done by including \"h2\" or \"h2c\" in the \"Protocols\" list in a configuration file. The following command can be used to search for possible vulnerable configurations: \n\n grep -R \u0027^\\s*Protocols\\\u003e.*\\\u003ch2\\\u003e\u0027 /etc/httpd/\n\nSee https://httpd.apache.org/docs/2.4/mod/mod_http2.html", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: memory corruption on early pushes" }, { "cve": "CVE-2019-10082", "discovery_date": "2019-08-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1743974" } ], "notes": [ { "category": "description", "text": "A read-after-free vulnerability was discovered in Apache httpd, in mod_http2. A specially crafted http/2 client session could cause the server to read memory that was previously freed during connection shutdown, potentially leading to a crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: read-after-free in h2 connection shutdown", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10082" }, { "category": "external", "summary": "RHBZ#1743974", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743974" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10082", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10082" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10082", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10082" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-08-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:28:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1337" }, { "category": "workaround", "details": "This flaw is only exploitable if Apache httpd is configured to respond to HTTP/2 requests, which is done by including \"h2\" or \"h2c\" in the \"Protocols\" list in a configuration file. The following command can be used to search for possible vulnerable configurations: \n\n grep -R \u0027^\\s*Protocols\\\u003e.*\\\u003ch2\\\u003e\u0027 /etc/httpd/\n\nSee https://httpd.apache.org/docs/2.4/mod/mod_http2.html", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: read-after-free in h2 connection shutdown" }, { "cve": "CVE-2019-10092", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-08-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1743956" } ], "notes": [ { "category": "description", "text": "A cross-site scripting vulnerability was found in Apache httpd, affecting the mod_proxy error page. Under certain circumstances, a crafted link could inject content into the HTML displayed in the error page, potentially leading to client-side exploitation.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: limited cross-site scripting in mod_proxy error page", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10092" }, { "category": "external", "summary": "RHBZ#1743956", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743956" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10092", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10092" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10092", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10092" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-08-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:28:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1337" }, { "category": "workaround", "details": "This flaw is only exploitable if Proxy* directives are used in Apache httpd configuration. The following command can be used to search for possible vulnerable configurations:\n\n grep -R \u0027^\\s*Proxy\u0027 /etc/httpd/\n\nSee https://httpd.apache.org/docs/2.4/mod/mod_proxy.html", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: limited cross-site scripting in mod_proxy error page" }, { "cve": "CVE-2019-10097", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-08-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1743996" } ], "notes": [ { "category": "description", "text": "A vulnerability was discovered in Apache httpd, in mod_remoteip. A trusted proxy using the \"PROXY\" protocol could send specially crafted headers that can cause httpd to experience a stack buffer overflow or NULL pointer dereference, leading to a crash or other potential consequences.\r\n\r\nThis issue could only be exploited by configured trusted intermediate proxy servers. HTTP clients such as browsers could not exploit the vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: null-pointer dereference in mod_remoteip", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10097" }, { "category": "external", "summary": "RHBZ#1743996", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743996" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10097", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10097" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10097", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10097" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-08-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:28:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1337" }, { "category": "workaround", "details": "This flaw is only exploitable if RemoteIP* directives are used in Apache httpd configuration. The following command can be used to search for possible vulnerable configurations:\n\n grep -R \u0027^\\s*RemoteIP\u0027 /etc/httpd/\n\nSee https://httpd.apache.org/docs/2.4/mod/mod_remoteip.html", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: null-pointer dereference in mod_remoteip" }, { "cve": "CVE-2019-10098", "discovery_date": "2019-08-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1743959" } ], "notes": [ { "category": "description", "text": "A vulnerability was discovered in Apache httpd, in mod_rewrite. Certain self-referential mod_rewrite rules could be fooled by encoded newlines, causing them to redirect to an unexpected location. An attacker could abuse this flaw in a phishing attack or as part of a client-side attack on browsers.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_rewrite potential open redirect", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10098" }, { "category": "external", "summary": "RHBZ#1743959", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743959" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10098", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10098" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10098", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10098" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-08-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:28:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1337" }, { "category": "workaround", "details": "This flaw requires the use of certain Rewrite configuration directives. The following command can be used to search for possible vulnerable configurations:\n\n grep -R \u0027^\\s*Rewrite\u0027 /etc/httpd/\n\nSee https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_rewrite potential open redirect" }, { "cve": "CVE-2020-1927", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2020-04-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1820761" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache HTTP Server (httpd) versions 2.4.0 to 2.4.41. Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirected instead to an unexpected URL within the request URL.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_rewrite configurations vulnerable to open redirect", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue only affects httpd versions between 2.4.0 and 2.4.41. Therefore Red Hat Enterprise Linux 5 and 6 are not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1927" }, { "category": "external", "summary": "RHBZ#1820761", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1820761" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1927", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1927" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1927", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1927" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2020-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-06T19:28:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1337" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6.x86_64", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_rewrite configurations vulnerable to open redirect" } ] }
icsa-21-336-06
Vulnerability from csaf_cisa
Notes
{ "document": { "acknowledgments": [ { "organization": "Hitachi Energy", "summary": "reporting to CISA that Transformer APM Edge contains open-source components with these known vulnerabilities" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en-US", "notes": [ { "category": "general", "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov", "title": "CISA Disclaimer" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "summary", "text": "Successful exploitation of this vulnerability could cause the product to become inaccessible.", "title": "Risk evaluation" }, { "category": "other", "text": "Energy", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Switzerland", "title": "Company headquarters location" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" }, { "category": "other", "text": "No known public exploits specifically target this vulnerability. This vulnerability is not exploitable remotely.", "title": "Exploitability" } ], "publisher": { "category": "coordinator", "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "ICS Advisory ICSA-21-336-06 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-336-06.json" }, { "category": "self", "summary": "ICS Advisory ICSA-21-336-06 Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-336-06" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Hitachi Energy APM Edge", "tracking": { "current_release_date": "2021-12-02T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-21-336-06", "initial_release_date": "2021-12-02T00:00:00.000000Z", "revision_history": [ { "date": "2021-12-02T00:00:00.000000Z", "legacy_version": "Initial", "number": "1", "summary": "ICSA-21-336-06 Hitachi Energy APM Edge" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "3.0", "product": { "name": "APM Edge: Version 3.0", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "APM Edge" }, { "branches": [ { "category": "product_version", "name": "2.0", "product": { "name": "APM Edge: Version 2.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "APM Edge" }, { "branches": [ { "category": "product_version", "name": "1.0", "product": { "name": "APM Edge: Version 1.0", "product_id": "CSAFPID-0003" } } ], "category": "product_name", "name": "APM Edge" } ], "category": "vendor", "name": "Hitachi Energy" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3449", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "summary", "text": "An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-1971", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "summary", "text": "Hitachi Energy is aware of public reports of this vulnerability in the following open-source software components: OpenSSL, LibSSL, libxml2 and GRUB2 bootloader. The vulnerability also affects some APM Edge products. An attacker who successfully exploits this vulnerability could cause the product to become inaccessible. SEE NVD for full Description.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2019-1563", "cwe": { "id": "CWE-327", "name": "Use of a Broken or Risky Cryptographic Algorithm" }, "notes": [ { "category": "summary", "text": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2019-1549", "cwe": { "id": "CWE-330", "name": "Use of Insufficiently Random Values" }, "notes": [ { "category": "summary", "text": "OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2019-1547", "cwe": { "id": "CWE-1357", "name": "Reliance on Insufficiently Trustworthy Component" }, "notes": [ { "category": "summary", "text": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2021-23840", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "summary", "text": "Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2021-23841", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "summary", "text": "The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2017-8872", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "summary", "text": "The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2019-20388", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "notes": [ { "category": "summary", "text": "xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-24977", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "summary", "text": "GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2021-3516", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "summary", "text": "There\u0027s a flaw in libxml2\u0027s xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2021-3517", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2021-3518", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "summary", "text": "There\u0027s a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2021-3537", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "summary", "text": "A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2021-3541", "cwe": { "id": "CWE-776", "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)" }, "notes": [ { "category": "summary", "text": "A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-10713", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "notes": [ { "category": "summary", "text": "A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-14308", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "summary", "text": "In grub2 versions before 2.06 the grub memory allocator doesn\u0027t check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-14309", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "There\u0027s an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 6.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-14310", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn\u0027t verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized allocation and further heap-based buffer overflow.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 6.0, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-14311", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32_MAX causes an arithmetic overflow leading to a zero-sized memory allocation with subsequent heap-based buffer overflow.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 6.0, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-15705", "cwe": { "id": "CWE-347", "name": "Improper Verification of Cryptographic Signature" }, "notes": [ { "category": "summary", "text": "GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-15706", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "summary", "text": "GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-15707", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "summary", "text": "Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-14372", "cwe": { "id": "CWE-184", "name": "Incomplete List of Disallowed Inputs" }, "notes": [ { "category": "summary", "text": "A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-25632", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "summary", "text": "A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-27749", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution which could also circumvent Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 6.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2020-27779", "cwe": { "id": "CWE-285", "name": "Improper Authorization" }, "notes": [ { "category": "summary", "text": "A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub\u0027s memory layout. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2021-20225", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 6.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2021-20233", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3449" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1971" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1563" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1547" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23841" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8872" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20388" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24977" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3516" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3517" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3518" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3537" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37182" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10713" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14308" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14309" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14310" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14311" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15705" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15706" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15707" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14372" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25632" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27779" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20225" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20233" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Physically protect process control systems from direct access by unauthorized personnel.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Do not directly connect to the Internet.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Separated from other networks by means of a firewall system that has a minimal number of ports exposed.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] }, { "category": "mitigation", "details": "Please see Hitachi Energy advisory 8DBD000057 for additional mitigation and update information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000057\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch" } ], "scores": [ { "cvss_v3": { "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003" ] } ] } ] }
gsd-2019-1547
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2019-1547", "description": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "id": "GSD-2019-1547", "references": [ "https://www.suse.com/security/cve/CVE-2019-1547.html", "https://www.debian.org/security/2019/dsa-4539", "https://www.debian.org/security/2019/dsa-4540", "https://access.redhat.com/errata/RHSA-2020:1840", "https://access.redhat.com/errata/RHSA-2020:1337", "https://access.redhat.com/errata/RHSA-2020:1336", "https://ubuntu.com/security/CVE-2019-1547", "https://advisories.mageia.org/CVE-2019-1547.html", "https://linux.oracle.com/cve/CVE-2019-1547.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2019-1547" ], "details": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "id": "GSD-2019-1547", "modified": "2023-12-13T01:23:51.566240Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "openssl-security@openssl.org", "DATE_PUBLIC": "2019-09-10", "ID": "CVE-2019-1547", "STATE": "PUBLIC", "TITLE": "ECDSA remote timing attack" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "OpenSSL", "version": { "version_data": [ { "version_value": "Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c)" }, { "version_value": "Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k)" }, { "version_value": "Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s)" } ] } } ] }, "vendor_name": "OpenSSL" } ] } }, "credit": [ { "lang": "eng", "value": "Cesar Pereida Garc\u00eda, Sohaib ul Hassan, Nicola Tuveri, Iaroslav Gridin, Alejandro Cabrera Aldaya, and Billy Brumley" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s)." } ] }, "impact": [ { "lang": "eng", "url": "https://www.openssl.org/policies/secpolicy.html#Low", "value": "Low" } ], "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Timing side channel" } ] } ] }, "references": { "reference_data": [ { "name": "20190912 [slackware-security] openssl (SSA:2019-254-03)", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Sep/25" }, { "name": "openSUSE-SU-2019:2158", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html" }, { "name": "FEDORA-2019-d15aac6c4e", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/" }, { "name": "openSUSE-SU-2019:2189", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html" }, { "name": "[debian-lts-announce] 20190925 [SECURITY] [DLA 1932-1] openssl security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html" }, { "name": "FEDORA-2019-d51641f152", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/" }, { "name": "20191001 [SECURITY] [DSA 4539-1] openssl security update", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Oct/1" }, { "name": "20191001 [SECURITY] [DSA 4540-1] openssl1.0 security update", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Oct/0" }, { "name": "DSA-4539", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2019/dsa-4539" }, { "name": "DSA-4540", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2019/dsa-4540" }, { "name": "openSUSE-SU-2019:2268", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html" }, { "name": "openSUSE-SU-2019:2269", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html" }, { "name": "GLSA-201911-04", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201911-04" }, { "name": "USN-4376-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4376-1/" }, { "name": "https://www.oracle.com/security-alerts/cpuapr2020.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "name": "https://www.oracle.com/security-alerts/cpujul2020.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpujul2020.html" }, { "name": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", "refsource": "MISC", "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html" }, { "name": "https://www.tenable.com/security/tns-2019-08", "refsource": "CONFIRM", "url": "https://www.tenable.com/security/tns-2019-08" }, { "name": "https://www.oracle.com/security-alerts/cpujan2020.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpujan2020.html" }, { "name": "https://www.openssl.org/news/secadv/20190910.txt", "refsource": "CONFIRM", "url": "https://www.openssl.org/news/secadv/20190910.txt" }, { "name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=30c22fa8b1d840036b8e203585738df62a03cec8", "refsource": "CONFIRM", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=30c22fa8b1d840036b8e203585738df62a03cec8" }, { "name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=7c1709c2da5414f5b6133d00a03fc8c5bf996c7a", "refsource": "CONFIRM", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=7c1709c2da5414f5b6133d00a03fc8c5bf996c7a" }, { "name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=21c856b75d81eff61aa63b4f036bb64a85bf6d46", "refsource": "CONFIRM", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=21c856b75d81eff61aa63b4f036bb64a85bf6d46" }, { "name": "https://arxiv.org/abs/1909.01785", "refsource": "MISC", "url": "https://arxiv.org/abs/1909.01785" }, { "name": "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html" }, { "name": "https://security.netapp.com/advisory/ntap-20190919-0002/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20190919-0002/" }, { "name": "https://support.f5.com/csp/article/K73422160?utm_source=f5support\u0026amp;utm_medium=RSS", "refsource": "CONFIRM", "url": "https://support.f5.com/csp/article/K73422160?utm_source=f5support\u0026amp;utm_medium=RSS" }, { "name": "https://www.tenable.com/security/tns-2019-09", "refsource": "CONFIRM", "url": "https://www.tenable.com/security/tns-2019-09" }, { "name": "https://security.netapp.com/advisory/ntap-20200122-0002/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20200122-0002/" }, { "name": "https://security.netapp.com/advisory/ntap-20200416-0003/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20200416-0003/" }, { "name": "USN-4376-2", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4376-2/" }, { "name": "USN-4504-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4504-1/" }, { "name": "https://www.oracle.com/security-alerts/cpuoct2020.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuoct2020.html" }, { "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365", "refsource": "CONFIRM", "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "1.0.2s", "versionStartIncluding": "1.0.2", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "1.1.0k", "versionStartIncluding": "1.1.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "1.1.1c", "versionStartIncluding": "1.1.1", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "openssl-security@openssl.org", "ID": "CVE-2019-1547" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s)." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "NVD-CWE-noinfo" } ] } ] }, "references": { "reference_data": [ { "name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=7c1709c2da5414f5b6133d00a03fc8c5bf996c7a", "refsource": "CONFIRM", "tags": [ "Mailing List", "Patch", "Vendor Advisory" ], "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=7c1709c2da5414f5b6133d00a03fc8c5bf996c7a" }, { "name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=21c856b75d81eff61aa63b4f036bb64a85bf6d46", "refsource": "CONFIRM", "tags": [ "Mailing List", "Patch", "Vendor Advisory" ], "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=21c856b75d81eff61aa63b4f036bb64a85bf6d46" }, { "name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=30c22fa8b1d840036b8e203585738df62a03cec8", "refsource": "CONFIRM", "tags": [ "Mailing List", "Patch", "Vendor Advisory" ], "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=30c22fa8b1d840036b8e203585738df62a03cec8" }, { "name": "https://www.openssl.org/news/secadv/20190910.txt", "refsource": "CONFIRM", "tags": [ "Vendor Advisory" ], "url": "https://www.openssl.org/news/secadv/20190910.txt" }, { "name": "https://arxiv.org/abs/1909.01785", "refsource": "MISC", "tags": [ "Third Party Advisory" ], "url": "https://arxiv.org/abs/1909.01785" }, { "name": "20190912 [slackware-security] openssl (SSA:2019-254-03)", "refsource": "BUGTRAQ", "tags": [ "Third Party Advisory" ], "url": "https://seclists.org/bugtraq/2019/Sep/25" }, { "name": "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html", "refsource": "MISC", "tags": [], "url": "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html" }, { "name": "https://security.netapp.com/advisory/ntap-20190919-0002/", "refsource": "CONFIRM", "tags": [], "url": "https://security.netapp.com/advisory/ntap-20190919-0002/" }, { "name": "openSUSE-SU-2019:2158", "refsource": "SUSE", "tags": [], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html" }, { "name": "FEDORA-2019-d15aac6c4e", "refsource": "FEDORA", "tags": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/" }, { "name": "openSUSE-SU-2019:2189", "refsource": "SUSE", "tags": [], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html" }, { "name": "[debian-lts-announce] 20190925 [SECURITY] [DLA 1932-1] openssl security update", "refsource": "MLIST", "tags": [], "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html" }, { "name": "FEDORA-2019-d51641f152", "refsource": "FEDORA", "tags": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/" }, { "name": "20191001 [SECURITY] [DSA 4539-1] openssl security update", "refsource": "BUGTRAQ", "tags": [], "url": "https://seclists.org/bugtraq/2019/Oct/1" }, { "name": "20191001 [SECURITY] [DSA 4540-1] openssl1.0 security update", "refsource": "BUGTRAQ", "tags": [], "url": "https://seclists.org/bugtraq/2019/Oct/0" }, { "name": "DSA-4539", "refsource": "DEBIAN", "tags": [], "url": "https://www.debian.org/security/2019/dsa-4539" }, { "name": "DSA-4540", "refsource": "DEBIAN", "tags": [], "url": "https://www.debian.org/security/2019/dsa-4540" }, { "name": "openSUSE-SU-2019:2268", "refsource": "SUSE", "tags": [], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html" }, { "name": "openSUSE-SU-2019:2269", "refsource": "SUSE", "tags": [], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html" }, { "name": "https://support.f5.com/csp/article/K73422160?utm_source=f5support\u0026amp;utm_medium=RSS", "refsource": "CONFIRM", "tags": [], "url": "https://support.f5.com/csp/article/K73422160?utm_source=f5support\u0026amp;utm_medium=RSS" }, { "name": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", "refsource": "MISC", "tags": [], "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html" }, { "name": "GLSA-201911-04", "refsource": "GENTOO", "tags": [], "url": "https://security.gentoo.org/glsa/201911-04" }, { "name": "https://www.tenable.com/security/tns-2019-08", "refsource": "CONFIRM", "tags": [], "url": "https://www.tenable.com/security/tns-2019-08" }, { "name": "https://www.tenable.com/security/tns-2019-09", "refsource": "CONFIRM", "tags": [], "url": "https://www.tenable.com/security/tns-2019-09" }, { "name": "https://www.oracle.com/security-alerts/cpujan2020.html", "refsource": "MISC", "tags": [], "url": "https://www.oracle.com/security-alerts/cpujan2020.html" }, { "name": "https://security.netapp.com/advisory/ntap-20200122-0002/", "refsource": "CONFIRM", "tags": [], "url": "https://security.netapp.com/advisory/ntap-20200122-0002/" }, { "name": "N/A", "refsource": "N/A", "tags": [], "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "name": "USN-4376-1", "refsource": "UBUNTU", "tags": [], "url": "https://usn.ubuntu.com/4376-1/" }, { "name": "https://security.netapp.com/advisory/ntap-20200416-0003/", "refsource": "CONFIRM", "tags": [], "url": "https://security.netapp.com/advisory/ntap-20200416-0003/" }, { "name": "https://www.oracle.com/security-alerts/cpujul2020.html", "refsource": "MISC", "tags": [], "url": "https://www.oracle.com/security-alerts/cpujul2020.html" }, { "name": "USN-4376-2", "refsource": "UBUNTU", "tags": [], "url": "https://usn.ubuntu.com/4376-2/" }, { "name": "USN-4504-1", "refsource": "UBUNTU", "tags": [], "url": "https://usn.ubuntu.com/4504-1/" }, { "name": "https://www.oracle.com/security-alerts/cpuoct2020.html", "refsource": "MISC", "tags": [], "url": "https://www.oracle.com/security-alerts/cpuoct2020.html" }, { "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365", "refsource": "CONFIRM", "tags": [], "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.9, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0" }, "exploitabilityScore": 3.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 1.0, "impactScore": 3.6 } }, "lastModifiedDate": "2021-07-31T08:15Z", "publishedDate": "2019-09-10T17:15Z" } } }
wid-sec-w-2023-1049
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "MySQL ist ein Open Source Datenbankserver von Oracle.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- MacOS X\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-1049 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2023-1049.json" }, { "category": "self", "summary": "WID-SEC-2023-1049 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1049" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS2-2023-2017 vom 2023-04-21", "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-2017.html" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - April 2020 vom 2020-04-14", "url": "https://www.oracle.com/security-alerts/cpuapr2020.html#AppendixMSQL" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:1810 vom 2020-04-28", "url": "https://access.redhat.com/errata/RHSA-2020:1810" }, { "category": "external", "summary": "Ubuntu Security Notice USN-4350-1 vom 2020-05-04", "url": "https://usn.ubuntu.com/4350-1/" }, { "category": "external", "summary": "Debian Security Advisory DLA 2245 vom 2020-06-12", "url": "https://lists.debian.org/debian-lts-announce/2020/debian-lts-announce-202006/msg00015.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-4703 vom 2020-06-11", "url": "https://www.debian.org/security/2020/dsa-4703" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2020:1710-1 vom 2020-06-23", "url": "http://lists.suse.com/pipermail/sle-security-updates/2020-June/007007.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2020:1711-1 vom 2020-06-23", "url": "http://lists.suse.com/pipermail/sle-security-updates/2020-June/007010.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:3194 vom 2020-07-28", "url": "https://access.redhat.com/errata/RHSA-2020:3194" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:3518 vom 2020-08-19", "url": "https://access.redhat.com/errata/RHSA-2020:3518" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:3732 vom 2020-09-14", "url": "https://access.redhat.com/errata/RHSA-2020:3732" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:3755 vom 2020-09-15", "url": "https://access.redhat.com/errata/RHSA-2020:3755" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:3757 vom 2020-09-15", "url": "https://access.redhat.com/errata/RHSA-2020:3757" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:4026 vom 2020-09-29", "url": "https://access.redhat.com/errata/RHSA-2020:4026" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:4174 vom 2020-10-05", "url": "https://access.redhat.com/errata/RHSA-2020:4174" }, { "category": "external", "summary": "AVAYA Security Advisory ASA-2020-112 vom 2020-10-25", "url": "https://downloads.avaya.com/css/P8/documents/101071742" }, { "category": "external", "summary": "Ubuntu Security Notice USN-4603-1 vom 2020-10-27", "url": "https://ubuntu.com/security/notices/USN-4603-1" }, { "category": "external", "summary": "Ubuntu Security Notice USN-4603-1 vom 2020-10-27", "url": "https://usn.ubuntu.com/4603-1/" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:4442 vom 2020-11-04", "url": "https://access.redhat.com/errata/RHSA-2020:4442" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:4961 vom 2020-11-05", "url": "https://access.redhat.com/errata/RHSA-2020:4961" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:4960 vom 2020-11-05", "url": "https://access.redhat.com/errata/RHSA-2020:4960" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:5246 vom 2020-11-30", "url": "https://access.redhat.com/errata/RHSA-2020:5246" }, { "category": "external", "summary": "AVAYA Security Advisory ASA-2020-162 vom 2020-12-08", "url": "https://downloads.avaya.com/css/P8/documents/101072831" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2020-5503 vom 2020-12-18", "url": "https://linux.oracle.com/errata/ELSA-2020-5503-1.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2020-5500 vom 2020-12-18", "url": "https://linux.oracle.com/errata/ELSA-2020-5500.html" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202105-27 vom 2021-05-26", "url": "https://security.gentoo.org/glsa/202105-27" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2021:0037 vom 2021-01-18", "url": "https://access.redhat.com/errata/RHSA-2021:0038" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:5635 vom 2021-02-24", "url": "https://access.redhat.com/errata/RHSA-2020:5635" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2021:2320-1 vom 2021-07-14", "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-July/009137.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2021:14771-1 vom 2021-07-29", "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-July/009231.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2021:2877-1 vom 2021-08-30", "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-August/009371.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2021:4396 vom 2021-11-09", "url": "https://access.redhat.com/errata/RHSA-2021:4396" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0318 vom 2022-01-27", "url": "https://access.redhat.com/errata/RHSA-2022:0318" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0434 vom 2022-02-04", "url": "https://access.redhat.com/errata/RHSA-2022:0434" } ], "source_lang": "en-US", "title": "Oracle MySQL: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-04-20T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:25:13.739+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-1049", "initial_release_date": "2020-04-14T22:00:00.000+00:00", "revision_history": [ { "date": "2020-04-14T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2020-04-28T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-05-03T22:00:00.000+00:00", "number": "3", "summary": "Referenz(en) aufgenommen: FEDORA-2020-261C9DDD7C, FEDORA-2020-136DC82437, FEDORA-2020-20AC7C92A1" }, { "date": "2020-05-04T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2020-06-11T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2020-06-23T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2020-07-28T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-08-19T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-09-14T22:00:00.000+00:00", "number": "9", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-09-15T22:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-09-29T22:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-10-05T22:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-10-25T23:00:00.000+00:00", "number": "13", "summary": "Neue Updates von AVAYA aufgenommen" }, { "date": "2020-10-27T23:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2020-11-03T23:00:00.000+00:00", "number": "15", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-11-05T23:00:00.000+00:00", "number": "16", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-11-30T23:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-12-09T23:00:00.000+00:00", "number": "18", "summary": "Neue Updates von AVAYA aufgenommen" }, { "date": "2020-12-17T23:00:00.000+00:00", "number": "19", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2021-01-18T23:00:00.000+00:00", "number": "20", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2021-02-24T23:00:00.000+00:00", "number": "21", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2021-05-25T22:00:00.000+00:00", "number": "22", "summary": "Neue Updates von Gentoo aufgenommen" }, { "date": "2021-07-14T22:00:00.000+00:00", "number": "23", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2021-07-29T22:00:00.000+00:00", "number": "24", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2021-08-30T22:00:00.000+00:00", "number": "25", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2021-11-09T23:00:00.000+00:00", "number": "26", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-01-27T23:00:00.000+00:00", "number": "27", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-02-03T23:00:00.000+00:00", "number": "28", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-04-20T22:00:00.000+00:00", "number": "29", "summary": "Neue Updates von Amazon aufgenommen" } ], "status": "final", "version": "29" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "category": "product_name", "name": "Avaya Aura Application Enablement Services", "product": { "name": "Avaya Aura Application Enablement Services", "product_id": "T015516", "product_identification_helper": { "cpe": "cpe:/a:avaya:aura_application_enablement_services:-" } } }, { "category": "product_name", "name": "Avaya Aura Communication Manager", "product": { "name": "Avaya Aura Communication Manager", "product_id": "T015126", "product_identification_helper": { "cpe": "cpe:/a:avaya:communication_manager:-" } } }, { "category": "product_name", "name": "Avaya Aura Experience Portal", "product": { "name": "Avaya Aura Experience Portal", "product_id": "T015519", "product_identification_helper": { "cpe": "cpe:/a:avaya:aura_experience_portal:-" } } }, { "category": "product_name", "name": "Avaya Aura Session Manager", "product": { "name": "Avaya Aura Session Manager", "product_id": "T015127", "product_identification_helper": { "cpe": "cpe:/a:avaya:session_manager:-" } } }, { "category": "product_name", "name": "Avaya Aura System Manager", "product": { "name": "Avaya Aura System Manager", "product_id": "T015518", "product_identification_helper": { "cpe": "cpe:/a:avaya:aura_system_manager:-" } } }, { "category": "product_name", "name": "Avaya Web License Manager", "product": { "name": "Avaya Web License Manager", "product_id": "T016243", "product_identification_helper": { "cpe": "cpe:/a:avaya:web_license_manager:-" } } } ], "category": "vendor", "name": "Avaya" }, { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } }, { "category": "product_name", "name": "Oracle MySQL", "product": { "name": "Oracle MySQL", "product_id": "T000197", "product_identification_helper": { "cpe": "cpe:/a:oracle:mysql:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-14889", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-14889" }, { "cve": "CVE-2019-1547", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-1547" }, { "cve": "CVE-2019-1549", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-1549" }, { "cve": "CVE-2019-1552", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-1552" }, { "cve": "CVE-2019-15601", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-15601" }, { "cve": "CVE-2019-1563", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-1563" }, { "cve": "CVE-2019-17563", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-17563" }, { "cve": "CVE-2019-19242", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-19242" }, { "cve": "CVE-2019-19244", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-19244" }, { "cve": "CVE-2019-19317", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-19317" }, { "cve": "CVE-2019-19603", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-19603" }, { "cve": "CVE-2019-19645", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-19645" }, { "cve": "CVE-2019-19646", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-19646" }, { "cve": "CVE-2019-19880", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-19880" }, { "cve": "CVE-2019-19923", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-19923" }, { "cve": "CVE-2019-19924", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-19924" }, { "cve": "CVE-2019-19925", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-19925" }, { "cve": "CVE-2019-19926", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-19926" }, { "cve": "CVE-2019-19959", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-19959" }, { "cve": "CVE-2019-20218", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-20218" }, { "cve": "CVE-2019-5481", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-5481" }, { "cve": "CVE-2019-5482", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2019-5482" }, { "cve": "CVE-2020-2752", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2752" }, { "cve": "CVE-2020-2759", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2759" }, { "cve": "CVE-2020-2760", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2760" }, { "cve": "CVE-2020-2761", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2761" }, { "cve": "CVE-2020-2762", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2762" }, { "cve": "CVE-2020-2763", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2763" }, { "cve": "CVE-2020-2765", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2765" }, { "cve": "CVE-2020-2768", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2768" }, { "cve": "CVE-2020-2770", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2770" }, { "cve": "CVE-2020-2774", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2774" }, { "cve": "CVE-2020-2779", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2779" }, { "cve": "CVE-2020-2780", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2780" }, { "cve": "CVE-2020-2790", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2790" }, { "cve": "CVE-2020-2804", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2804" }, { "cve": "CVE-2020-2806", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2806" }, { "cve": "CVE-2020-2812", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2812" }, { "cve": "CVE-2020-2814", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2814" }, { "cve": "CVE-2020-2853", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2853" }, { "cve": "CVE-2020-2875", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2875" }, { "cve": "CVE-2020-2892", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2892" }, { "cve": "CVE-2020-2893", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2893" }, { "cve": "CVE-2020-2895", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2895" }, { "cve": "CVE-2020-2896", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2896" }, { "cve": "CVE-2020-2897", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2897" }, { "cve": "CVE-2020-2898", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2898" }, { "cve": "CVE-2020-2901", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2901" }, { "cve": "CVE-2020-2903", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2903" }, { "cve": "CVE-2020-2904", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2904" }, { "cve": "CVE-2020-2921", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2921" }, { "cve": "CVE-2020-2922", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2922" }, { "cve": "CVE-2020-2923", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2923" }, { "cve": "CVE-2020-2924", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2924" }, { "cve": "CVE-2020-2925", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2925" }, { "cve": "CVE-2020-2926", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2926" }, { "cve": "CVE-2020-2928", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2928" }, { "cve": "CVE-2020-2930", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2930" }, { "cve": "CVE-2020-2933", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2933" }, { "cve": "CVE-2020-2934", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen in den Produkten MySQL Server, MySQL Workbench, MySQL Enterprise Monitor, MySQL Cluster, MySQL Client und MySQL Connectors. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015519", "T015518", "67646", "T015516", "T015127", "T015126", "T012167", "T004914", "T016243", "2951", "T002207", "T000126", "398363", "T000197" ] }, "release_date": "2020-04-14T22:00:00Z", "title": "CVE-2020-2934" } ] }
wid-sec-w-2023-1762
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "OpenSSL ist eine im Quelltext frei verf\u00fcgbare Bibliothek, die Secure Sockets Layer (SSL) und Transport Layer Security (TLS) implementiert.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um Sicherheitsvorkehrungen zu umgehen.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-1762 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2019/wid-sec-w-2023-1762.json" }, { "category": "self", "summary": "WID-SEC-2023-1762 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1762" }, { "category": "external", "summary": "OpenSSL Security Advisory vom 2019-09-10", "url": "https://www.openssl.org/news/secadv/20190910.txt" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:14171-1 vom 2019-09-18", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-201914171-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:2403-1 vom 2019-09-19", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20192403-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:2397-1 vom 2019-09-19", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20192397-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:14174-1 vom 2019-09-20", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-201914174-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:2413-1 vom 2019-09-20", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20192413-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:2410-1 vom 2019-09-20", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20192410-1.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-4540 vom 2019-10-02", "url": "http://www.debian.org/security/2019/dsa-4540" }, { "category": "external", "summary": "Debian Security Advisory DSA-4539 vom 2019-10-02", "url": "http://www.debian.org/security/2019/dsa-4539" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:2504-1 vom 2019-10-01", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20192504-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:2558-1 vom 2019-10-04", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20192558-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:2561-1 vom 2019-10-04", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20192561-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2020:0099-1 vom 2020-01-15", "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20200099-1.html" }, { "category": "external", "summary": "Gentoo Security Advisory GLSA 201911-04 vom 2019-11-07", "url": "https://security.gentoo.org/glsa/201911-04" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:14249-1 vom 2019-12-13", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-201914249-1.html" }, { "category": "external", "summary": "Netapp Security Advisory", "url": "https://security.netapp.com/advisory/ntap-20190919-0002/" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:1337 vom 2020-04-06", "url": "https://access.redhat.com/errata/RHSA-2020:1337" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:1336 vom 2020-04-06", "url": "https://access.redhat.com/errata/RHSA-2020:1336" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:1840 vom 2020-04-28", "url": "https://access.redhat.com/errata/RHSA-2020:1840" }, { "category": "external", "summary": "Ubuntu Security Notice USN-4376-1 vom 2020-05-28", "url": "https://usn.ubuntu.com/4376-1/" }, { "category": "external", "summary": "Ubuntu Security Notice USN-4376-2 vom 2020-07-09", "url": "https://usn.ubuntu.com/4376-2/" }, { "category": "external", "summary": "EMC Security Advisory DSA-2020-179 vom 2020-07-14", "url": "https://www.dell.com/support/security/de-de/details/545120/DSA-2020-179-Dell-EMC-Data-Domain-Security-Update-for-OpenSSL-Vulnerabilities" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:3194 vom 2020-07-28", "url": "https://access.redhat.com/errata/RHSA-2020:3194" }, { "category": "external", "summary": "Sophos UTM Up2Date", "url": "https://community.sophos.com/products/unified-threat-management/b/blog/posts/utm-up2date-9-704-released" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2020:2634-1 vom 2020-09-15", "url": "http://lists.suse.com/pipermail/sle-security-updates/2020-September/007427.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-4504-1 vom 2020-09-16", "url": "https://usn.ubuntu.com/4504-1/" }, { "category": "external", "summary": "HPE Security Bulletin", "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbux04160en_us" }, { "category": "external", "summary": "Dell Knowledge Base Article", "url": "https://www.dell.com/support/kbdoc/en-us/000221474/dsa-2024-059-security-update-for-dell-networker-multiple-components-vulnerabilities" }, { "category": "external", "summary": "Hitachi Vulnerability Information HITACHI-SEC-2023-126 vom 2023-07-18", "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-126/index.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-13025 vom 2023-12-07", "url": "https://linux.oracle.com/errata/ELSA-2023-13025.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-13024 vom 2023-12-07", "url": "https://linux.oracle.com/errata/ELSA-2023-13024.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-13026 vom 2023-12-07", "url": "https://linux.oracle.com/errata/ELSA-2023-13026.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-13027 vom 2023-12-07", "url": "https://linux.oracle.com/errata/ELSA-2023-13027.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-32790 vom 2023-12-07", "url": "https://linux.oracle.com/errata/ELSA-2023-32790.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-32791 vom 2023-12-07", "url": "https://linux.oracle.com/errata/ELSA-2023-32791.html" }, { "category": "external", "summary": "IBM Security Bulletin 7145367 vom 2024-03-27", "url": "https://www.ibm.com/support/pages/node/7145367" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-12408 vom 2024-06-05", "url": "https://linux.oracle.com/errata/ELSA-2024-12408.html" } ], "source_lang": "en-US", "title": "OpenSSL: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen", "tracking": { "current_release_date": "2024-06-04T22:00:00.000+00:00", "generator": { "date": "2024-06-05T08:09:18.262+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-1762", "initial_release_date": "2019-09-10T22:00:00.000+00:00", "revision_history": [ { "date": "2019-09-10T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2019-09-17T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2019-09-18T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2019-09-19T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2019-09-22T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2019-10-01T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Debian und SUSE aufgenommen" }, { "date": "2019-10-06T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2019-11-07T23:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Gentoo" }, { "date": "2019-12-12T23:00:00.000+00:00", "number": "9", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2020-01-14T23:00:00.000+00:00", "number": "10", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2020-02-23T23:00:00.000+00:00", "number": "11", "summary": "Neue Updates von NetApp aufgenommen" }, { "date": "2020-04-06T22:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-04-28T22:00:00.000+00:00", "number": "13", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-05-28T22:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2020-07-09T22:00:00.000+00:00", "number": "15", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2020-07-13T22:00:00.000+00:00", "number": "16", "summary": "Neue Updates von EMC aufgenommen" }, { "date": "2020-07-28T22:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-08-05T22:00:00.000+00:00", "number": "18", "summary": "Neue Updates aufgenommen" }, { "date": "2020-09-15T22:00:00.000+00:00", "number": "19", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2020-09-16T22:00:00.000+00:00", "number": "20", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2021-06-09T22:00:00.000+00:00", "number": "21", "summary": "Neue Updates von HP aufgenommen" }, { "date": "2023-07-17T22:00:00.000+00:00", "number": "22", "summary": "Neue Updates von HITACHI aufgenommen" }, { "date": "2023-07-18T22:00:00.000+00:00", "number": "23", "summary": "Hitachi Produkte erg\u00e4nzt." }, { "date": "2023-12-07T23:00:00.000+00:00", "number": "24", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-01-25T23:00:00.000+00:00", "number": "25", "summary": "Neue Updates von Dell aufgenommen" }, { "date": "2024-03-27T23:00:00.000+00:00", "number": "26", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-06-04T22:00:00.000+00:00", "number": "27", "summary": "Neue Updates von Oracle Linux aufgenommen" } ], "status": "final", "version": "27" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c19.10", "product": { "name": "Dell NetWorker \u003c19.10", "product_id": "T032354", "product_identification_helper": { "cpe": "cpe:/a:dell:networker:19.10" } } } ], "category": "product_name", "name": "NetWorker" } ], "category": "vendor", "name": "Dell" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "category": "product_name", "name": "HPE HP-UX", "product": { "name": "HPE HP-UX", "product_id": "4871", "product_identification_helper": { "cpe": "cpe:/o:hp:hp-ux:-" } } } ], "category": "vendor", "name": "HPE" }, { "branches": [ { "category": "product_name", "name": "Hitachi Command Suite", "product": { "name": "Hitachi Command Suite", "product_id": "T010951", "product_identification_helper": { "cpe": "cpe:/a:hitachi:command_suite:-" } } }, { "category": "product_name", "name": "Hitachi Configuration Manager", "product": { "name": "Hitachi Configuration Manager", "product_id": "T020304", "product_identification_helper": { "cpe": "cpe:/a:hitachi:configuration_manager:-" } } }, { "category": "product_name", "name": "Hitachi Ops Center", "product": { "name": "Hitachi Ops Center", "product_id": "T017562", "product_identification_helper": { "cpe": "cpe:/a:hitachi:ops_center:-" } } } ], "category": "vendor", "name": "Hitachi" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c7.5.0 UP8", "product": { "name": "IBM QRadar SIEM \u003c7.5.0 UP8", "product_id": "T033681", "product_identification_helper": { "cpe": "cpe:/a:ibm:qradar_siem:7.5.0_up8" } } } ], "category": "product_name", "name": "QRadar SIEM" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "category": "product_name", "name": "NetApp Data ONTAP", "product": { "name": "NetApp Data ONTAP", "product_id": "7654", "product_identification_helper": { "cpe": "cpe:/a:netapp:data_ontap:-" } } }, { "category": "product_name", "name": "NetApp FAS", "product": { "name": "NetApp FAS", "product_id": "T011540", "product_identification_helper": { "cpe": "cpe:/h:netapp:fas:-" } } } ], "category": "vendor", "name": "NetApp" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c1.1.1d", "product": { "name": "Open Source OpenSSL \u003c1.1.1d", "product_id": "T014979", "product_identification_helper": { "cpe": "cpe:/a:openssl:openssl:1.1.1d" } } }, { "category": "product_version_range", "name": "\u003c1.1.0l", "product": { "name": "Open Source OpenSSL \u003c1.1.0l", "product_id": "T014980", "product_identification_helper": { "cpe": "cpe:/a:openssl:openssl:1.1.0l" } } }, { "category": "product_version_range", "name": "\u003c1.0.2t", "product": { "name": "Open Source OpenSSL \u003c1.0.2t", "product_id": "T014981", "product_identification_helper": { "cpe": "cpe:/a:openssl:openssl:1.0.2t" } } } ], "category": "product_name", "name": "OpenSSL" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-1547", "notes": [ { "category": "description", "text": "In OpenSSL existieren mehrere Schwachstellen. Diese bestehen aufgrund von Fehlern bei der Nutzung eigener elliptischer Kurven in EC Gruppen, bei der Fork Protection und der Verschl\u00fcsselung von CMS/PKCS7 transportierten Schl\u00fcsseln. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Kryptografie zu umgehen." } ], "product_status": { "known_affected": [ "67646", "4871", "7654", "T010951", "T011540", "T033681", "T012167", "T004914", "T032354", "T017562", "2951", "T002207", "T000126", "T020304" ] }, "release_date": "2019-09-10T22:00:00Z", "title": "CVE-2019-1547" }, { "cve": "CVE-2019-1549", "notes": [ { "category": "description", "text": "In OpenSSL existieren mehrere Schwachstellen. Diese bestehen aufgrund von Fehlern bei der Nutzung eigener elliptischer Kurven in EC Gruppen, bei der Fork Protection und der Verschl\u00fcsselung von CMS/PKCS7 transportierten Schl\u00fcsseln. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Kryptografie zu umgehen." } ], "product_status": { "known_affected": [ "67646", "4871", "7654", "T010951", "T011540", "T033681", "T012167", "T004914", "T032354", "T017562", "2951", "T002207", "T000126", "T020304" ] }, "release_date": "2019-09-10T22:00:00Z", "title": "CVE-2019-1549" }, { "cve": "CVE-2019-1563", "notes": [ { "category": "description", "text": "In OpenSSL existieren mehrere Schwachstellen. Diese bestehen aufgrund von Fehlern bei der Nutzung eigener elliptischer Kurven in EC Gruppen, bei der Fork Protection und der Verschl\u00fcsselung von CMS/PKCS7 transportierten Schl\u00fcsseln. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Kryptografie zu umgehen." } ], "product_status": { "known_affected": [ "67646", "4871", "7654", "T010951", "T011540", "T033681", "T012167", "T004914", "T032354", "T017562", "2951", "T002207", "T000126", "T020304" ] }, "release_date": "2019-09-10T22:00:00Z", "title": "CVE-2019-1563" } ] }
ghsa-q2qv-648h-wcqp
Vulnerability from github
Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
{ "affected": [], "aliases": [ "CVE-2019-1547" ], "database_specific": { "cwe_ids": [ "CWE-311" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2019-09-10T17:15:00Z", "severity": "MODERATE" }, "details": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "id": "GHSA-q2qv-648h-wcqp", "modified": "2024-06-21T21:33:48Z", "published": "2022-05-24T16:55:52Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1547" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20200122-0002" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20200416-0003" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20240621-0006" }, { "type": "WEB", "url": "https://support.f5.com/csp/article/K73422160?utm_source=f5support\u0026amp%3Butm_medium=RSS" }, { "type": "WEB", "url": "https://support.f5.com/csp/article/K73422160?utm_source=f5support\u0026amp;utm_medium=RSS" }, { "type": "WEB", "url": "https://usn.ubuntu.com/4376-1" }, { "type": "WEB", "url": "https://usn.ubuntu.com/4376-2" }, { "type": "WEB", "url": "https://usn.ubuntu.com/4504-1" }, { "type": "WEB", "url": "https://www.debian.org/security/2019/dsa-4539" }, { "type": "WEB", "url": "https://www.debian.org/security/2019/dsa-4540" }, { "type": "WEB", "url": "https://www.openssl.org/news/secadv/20190910.txt" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2020.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2020.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuoct2020.html" }, { "type": "WEB", "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html" }, { "type": "WEB", "url": "https://www.tenable.com/security/tns-2019-08" }, { "type": "WEB", "url": "https://www.tenable.com/security/tns-2019-09" }, { "type": "WEB", "url": "https://arxiv.org/abs/1909.01785" }, { "type": "WEB", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=21c856b75d81eff61aa63b4f036bb64a85bf6d46" }, { "type": "WEB", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=30c22fa8b1d840036b8e203585738df62a03cec8" }, { "type": "WEB", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7c1709c2da5414f5b6133d00a03fc8c5bf996c7a" }, { "type": "WEB", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=21c856b75d81eff61aa63b4f036bb64a85bf6d46" }, { "type": "WEB", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=30c22fa8b1d840036b8e203585738df62a03cec8" }, { "type": "WEB", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=7c1709c2da5414f5b6133d00a03fc8c5bf996c7a" }, { "type": "WEB", "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E" }, { "type": "WEB", "url": "https://seclists.org/bugtraq/2019/Oct/0" }, { "type": "WEB", "url": "https://seclists.org/bugtraq/2019/Oct/1" }, { "type": "WEB", "url": "https://seclists.org/bugtraq/2019/Sep/25" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/201911-04" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20190919-0002" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "type": "CVSS_V3" } ] }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.