{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "Several vulnerabilities in the Endress+Hauser SSG-E210GC product were discoverd. The advisory includes a total of 23 vulnerabilities, of which 14 are confirmed as affected and 9 as known not affected.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "If exploited, these vulnerabilities could potentially allow a remote, unauthenticated attacker to compromise the availability, integrity, and confidentiality of the SSG-E210GC. SICK therefore recommends ensuring that the product operates within a secure environment. Currently, SICK is not aware of any exploits targeting these vulnerabilities. ",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "Customers are strongly advised to apply the recommended workaround for the affected vulnerabilities to reduce potential risk.",
        "title": "Remediation"
      },
      {
        "category": "general",
        "text": "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Recommendation"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "psirt@sick.de",
      "issuing_authority": "SICK AG issues and issues in EHS products (when related to the Endress+Hauser SICK (EHS) joint venture).",
      "name": "SICK PSIRT",
      "namespace": "https://www.sick.com/psirt"
    },
    "references": [
      {
        "summary": "Endress+Hauser",
        "url": "https://www.endress.com"
      },
      {
        "summary": "SICK PSIRT Security Advisories",
        "url": "https://sick.com/psirt"
      },
      {
        "summary": "ICS-CERT recommended practices on Industrial Security",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "summary": "CVSS v3.1 Calculator",
        "url": "https://www.first.org/cvss/calculator/3.1"
      },
      {
        "category": "self",
        "summary": "The canonical URL.",
        "url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json"
      }
    ],
    "title": "Vulnerabilities affecting Endress+Hauser SSG-E210GC",
    "tracking": {
      "current_release_date": "2025-10-02T13:00:00.000Z",
      "generator": {
        "date": "2025-10-02T09:27:08.522Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.36"
        }
      },
      "id": "SCA-2025-0011",
      "initial_release_date": "2025-10-02T13:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-10-02T13:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser SSG-E210GC all versions",
                          "product_id": "CSAFPID-0001",
                          "product_identification_helper": {
                            "skus": [
                              "1124771"
                            ]
                          }
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "SSG-E210GC"
                  }
                ],
                "category": "product_name",
                "name": "SSG"
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Endress+Hauser SSG-E210GC Firmware all versions",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "Endress+Hauser"
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser SSG-E210GC all Firmware versions",
          "product_id": "CSAFPID-0003"
        },
        "product_reference": "CSAFPID-0002",
        "relates_to_product_reference": "CSAFPID-0001"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-38408",
      "cwe": {
        "id": "CWE-428",
        "name": "Unquoted Search Path or Element"
      },
      "notes": [
        {
          "category": "description",
          "text": "The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2023-38408"
    },
    {
      "cve": "CVE-2021-23017",
      "cwe": {
        "id": "CWE-193",
        "name": "Off-by-one Error"
      },
      "notes": [
        {
          "category": "description",
          "text": "A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2021-23017"
    },
    {
      "cve": "CVE-2020-12062",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client\u0027s download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that \"this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol\" and \"utimes does not fail under normal circumstances.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2020-12062"
    },
    {
      "cve": "CVE-2021-41874",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "An unauthorized access vulnerabiitly exists in all versions of Portainer, which could let a malicious user obtain sensitive information. NOTE: Portainer has received no detail of this CVE report. There is also no response after multiple attempts of contacting the original source.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2021-41874"
    },
    {
      "cve": "CVE-2021-25217",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "description",
          "text": "In ISC DHCP 4.1-ESV-R1 -\u003e 4.1-ESV-R16, ISC DHCP 4.4.0 -\u003e 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when reading an improper lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in lack of service to clients. Additionally, the offending lease and the lease immediately following it in the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not occur, but it is possible for the offending lease and the lease which immediately followed it to be improperly deleted.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.4,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 7.4,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2021-25217"
    },
    {
      "cve": "CVE-2021-3618",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomainto another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.4,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.4,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2021-3618"
    },
    {
      "cve": "CVE-2021-28041",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "SSH-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.1,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2021-28041"
    },
    {
      "cve": "CVE-2020-15778",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\"",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2020-15778"
    },
    {
      "cve": "CVE-2021-42650",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "Cross Site Scripting (XSS) vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 6.1,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 6.1,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2021-42650"
    },
    {
      "cve": "CVE-2016-20012",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "description",
          "text": "OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 5.3,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2016-20012"
    },
    {
      "cve": "CVE-2025-26465",
      "cwe": {
        "id": "CWE-390",
        "name": "Detection of Error Condition Without Action"
      },
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client\u0027s memory resource first, turning the attack complexity high.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.8,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 6.8,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2025-26465"
    },
    {
      "cve": "CVE-2019-20372",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 5.3,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2019-20372"
    },
    {
      "cve": "CVE-2020-14145",
      "cwe": {
        "id": "CWE-203",
        "name": "Observable Discrepancy"
      },
      "notes": [
        {
          "category": "description",
          "text": "The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 5.9,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2020-14145"
    },
    {
      "cve": "CVE-2021-36368",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "description",
          "text": "An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user\u0027s behalf. NOTE: the vendor\u0027s position is \"this is not an authentication bypass, since nothing is being bypassed.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.8,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 6.8,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2021-36368"
    },
    {
      "cve": "CVE-2022-24961",
      "cwe": {
        "id": "CWE-390",
        "name": "Detection of Error Condition Without Action"
      },
      "notes": [
        {
          "category": "description",
          "text": "In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days. The vulnerability allows the API server to run even when not linked to a Portainer instance recently, posing a security risk.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2022-24961"
    },
    {
      "cve": "CVE-2023-44487",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "description",
          "text": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2023-44487"
    },
    {
      "cve": "CVE-2021-41617",
      "cwe": {
        "id": "CWE-273",
        "name": "Improper Check for Dropped Privileges"
      },
      "notes": [
        {
          "category": "description",
          "text": "sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2021-41617"
    },
    {
      "cve": "CVE-2023-51767",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "description",
          "text": "OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2023-51767"
    },
    {
      "cve": "CVE-2008-3844",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally introduced modification (Trojan Horse) that allows the package authors to have an unknown impact. NOTE: since the malicious packages were not distributed from any official Red Hat sources, the scope of this issue is restricted to users who may have obtained these packages through unofficial distribution points. As of 20080827, no unofficial distributions of this software are known.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2008-3844"
    },
    {
      "cve": "CVE-2022-2929",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "description",
          "text": "In ISC DHCP 1.0 -\u003e 4.4.3, ISC DHCP 4.1-ESV-R1 -\u003e 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels longer than 63 bytes, could eventually cause the server to run out of memory.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2022-2929"
    },
    {
      "cve": "CVE-2022-2928",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "description",
          "text": "In ISC DHCP 4.4.0 -\u003e 4.4.3, ISC DHCP 4.1-ESV-R1 -\u003e 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option\u0027s refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2022-2928"
    },
    {
      "cve": "CVE-2023-48795",
      "cwe": {
        "id": "CWE-354",
        "name": "Improper Validation of Integrity Check Value"
      },
      "notes": [
        {
          "category": "description",
          "text": "The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH\u0027s use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.9,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2023-48795"
    },
    {
      "cve": "CVE-2007-2768",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "description",
          "text": "OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "environmentalScore": 3.7,
            "environmentalSeverity": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 3.7,
            "temporalSeverity": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2007-2768"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "SICK has identified multiple vulnerabilities in the SICK TDC-E210GC product. The advisory includes a total of 23 vulnerabilities, of which 14 are confirmed as affected and 9 as known not affected. At this time, SICK is not aware of any public exploits specifically targeting these vulnerabilities. Customers are strongly advised to apply the recommended workaround for the affected vulnerabilities to reduce potential risk.",
        "title": "summary"
      },
      {
        "category": "general",
        "text": "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Security Measures"
      },
      {
        "category": "general",
        "text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer\u2019s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
        "title": "Vulnerability Classification"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@sick.de",
      "issuing_authority": "SICK PSIRT is responsible for any vulnerabilities related to SICK products.",
      "name": "SICK PSIRT",
      "namespace": "https://www.sick.com/psirt"
    },
    "references": [
      {
        "summary": "SICK PSIRT Security Advisories",
        "url": "https://sick.com/psirt"
      },
      {
        "summary": "SICK Operating Guidelines",
        "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
      },
      {
        "summary": "ICS-CERT recommended practices on Industrial Security",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "summary": "CVSS v3.1 Calculator",
        "url": "https://www.first.org/cvss/calculator/3.1"
      },
      {
        "category": "self",
        "summary": "The canonical URL.",
        "url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0009.json"
      }
    ],
    "title": "Vulnerabilities affecting SICK TDC-E210GC",
    "tracking": {
      "current_release_date": "2025-08-01T13:00:00.000Z",
      "generator": {
        "date": "2025-08-01T08:14:37.621Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.32"
        }
      },
      "id": "SCA-2025-0009",
      "initial_release_date": "2025-08-01T13:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-08-01T13:00:00.000Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "SICK TDC-E210GC all versions",
                      "product_id": "CSAFPID-0001",
                      "product_identification_helper": {
                        "skus": [
                          "6070344"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "TDC-E210GC"
              }
            ],
            "category": "product_family",
            "name": "Telematic Data Collector"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK TDC-E210GC Firmware all versions",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "TDC-E210GC Firmware"
          }
        ],
        "category": "vendor",
        "name": "SICK AG"
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK TDC-E210GC all Firmware versions",
          "product_id": "CSAFPID-0003"
        },
        "product_reference": "CSAFPID-0002",
        "relates_to_product_reference": "CSAFPID-0001"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-38408",
      "cwe": {
        "id": "CWE-428",
        "name": "Unquoted Search Path or Element"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "OpenSSH Remote Code Execution Due to an Inssufficiently Trustworthy Search Path"
    },
    {
      "cve": "CVE-2021-23017",
      "cwe": {
        "id": "CWE-193",
        "name": "Off-by-one Error"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "NGINX Off-by-One Error"
    },
    {
      "cve": "CVE-2020-12062",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client\u0027s download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that \"this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol\" and \"utimes does not fail under normal circumstances.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "Inproper Input Validation in OpenSSH 8.2"
    },
    {
      "cve": "CVE-2021-41874",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An unauthorized access vulnerabiitly exists in all versions of Portainer, which could let a malicious user obtain sensitive information. NOTE: Portainer has received no detail of this CVE report. There is also no response after multiple attempts of contacting the original source.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "Unauthorized Access Vulnerabiitly in All Versions of Portainer"
    },
    {
      "cve": "CVE-2021-25217",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In ISC DHCP 4.1-ESV-R1 -\u003e 4.1-ESV-R16, ISC DHCP 4.4.0 -\u003e 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when reading an improper lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in lack of service to clients. Additionally, the offending lease and the lease immediately following it in the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not occur, but it is possible for the offending lease and the lease which immediately followed it to be improperly deleted.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.4,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 7.4,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "A Buffer Overrun in Lease File Parsing Code Can Be Used to Exploit a Common Vulnerability Shared by DHCPD and Dhclient"
    },
    {
      "cve": "CVE-2021-3618",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomainto another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.4,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.4,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "Broken Authentication of TLS"
    },
    {
      "cve": "CVE-2021-28041",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "SSH-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.1,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "Double Free in OpenSSH"
    },
    {
      "cve": "CVE-2020-15778",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\"",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "Command Injection in the OpenSSH scp.c to Remote Function"
    },
    {
      "cve": "CVE-2021-42650",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Cross Site Scripting (XSS) vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 6.1,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 6.1,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "Portainer XSS Vulnerability"
    },
    {
      "cve": "CVE-2016-20012",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "summary",
          "text": "OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 5.3,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "OpenSSH User Enumeration"
    },
    {
      "cve": "CVE-2025-26465",
      "cwe": {
        "id": "CWE-390",
        "name": "Detection of Error Condition Without Action"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client\u0027s memory resource first, turning the attack complexity high.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.8,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 6.8,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "OpenSSH VerifyHostKeyDNS Vulnerable to Mashine-in-the-Middle"
    },
    {
      "cve": "CVE-2019-20372",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 5.3,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "NGINX Allows HTTP Request Smuggling"
    },
    {
      "cve": "CVE-2020-14145",
      "cwe": {
        "id": "CWE-203",
        "name": "Observable Discrepancy"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk.\nThe collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 5.9,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "OpenSSH Information Leak in the Algorithm Negotiation"
    },
    {
      "cve": "CVE-2021-36368",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user\u0027s behalf. NOTE: the vendor\u0027s position is \"this is not an authentication bypass, since nothing is being bypassed.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources \"SICK Operating Guidelines\" and \"ICS-CERT recommended practices on Industrial Security\" could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.8,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 6.8,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "OpenSSH Vulnerable to Authentication Bypass"
    },
    {
      "cve": "CVE-2022-24961",
      "cwe": {
        "id": "CWE-390",
        "name": "Detection of Error Condition Without Action"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days. The vulnerability allows the API server to run even when not linked to a Portainer instance recently, posing a security risk.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "Portainer Agent API Server Vulnerability"
    },
    {
      "cve": "CVE-2023-44487",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "Denial of Service in HTTP/2 Protocol"
    },
    {
      "cve": "CVE-2021-41617",
      "cwe": {
        "id": "CWE-273",
        "name": "Improper Check for Dropped Privileges"
      },
      "notes": [
        {
          "category": "summary",
          "text": "sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "OpenSSH Privilege Escalation"
    },
    {
      "cve": "CVE-2023-51767",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "OpenSSH Authentication Bypass Vulnerability"
    },
    {
      "cve": "CVE-2008-3844",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally introduced modification (Trojan Horse) that allows the package authors to have an unknown impact. NOTE: since the malicious packages were not distributed from any official Red Hat sources, the scope of this issue is restricted to users who may have obtained these packages through unofficial distribution points. As of 20080827, no unofficial distributions of this software are known.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "Trojan Horse at RHEL4 for OpenSSH"
    },
    {
      "cve": "CVE-2022-2929",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In ISC DHCP 1.0 -\u003e 4.4.3, ISC DHCP 4.1-ESV-R1 -\u003e 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels longer than 63 bytes, could eventually cause the server to run out of memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "DHCP Memory Leak"
    },
    {
      "cve": "CVE-2022-2928",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In ISC DHCP 4.4.0 -\u003e 4.4.3, ISC DHCP 4.1-ESV-R1 -\u003e 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option\u0027s refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "An Option Refcount Overflow Exists in DHCPD"
    },
    {
      "cve": "CVE-2023-48795",
      "cwe": {
        "id": "CWE-354",
        "name": "Improper Validation of Integrity Check Value"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH\u0027s use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.9,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "OpenSSH Vulnerable for Bypassing Integrity Checks"
    },
    {
      "cve": "CVE-2007-2768",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "environmentalScore": 3.7,
            "environmentalSeverity": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 3.7,
            "temporalSeverity": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "OpenSSH User Enumeration Using OPIE"
    }
  ]
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202107-1672",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "vsftpd",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vsftpd",
        "version": "3.0.4"
      },
      {
        "model": "sendmail",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "sendmail",
        "version": "8.17"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "33"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.21.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "10.0"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "35"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "34"
      },
      {
        "model": "vsftpd",
        "scope": null,
        "trust": 0.8,
        "vendor": "vsftpd",
        "version": null
      },
      {
        "model": "nginx",
        "scope": null,
        "trust": 0.8,
        "vendor": "f5",
        "version": null
      },
      {
        "model": "fedora",
        "scope": null,
        "trust": 0.8,
        "vendor": "fedora",
        "version": null
      },
      {
        "model": "gnu/linux",
        "scope": null,
        "trust": 0.8,
        "vendor": "debian",
        "version": null
      },
      {
        "model": "sendmail",
        "scope": null,
        "trust": 0.8,
        "vendor": "sendmail consortium",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-019676"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-3618"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.21.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:sendmail:sendmail:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.17",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:vsftpd_project:vsftpd:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "3.0.4",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2021-3618"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Ubuntu",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "166709"
      },
      {
        "db": "PACKETSTORM",
        "id": "168672"
      },
      {
        "db": "PACKETSTORM",
        "id": "166888"
      },
      {
        "db": "PACKETSTORM",
        "id": "174729"
      }
    ],
    "trust": 0.4
  },
  "cve": "CVE-2021-3618",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.8,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2021-3618",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-395783",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.2,
            "impactScore": 5.2,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 7.4,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2021-3618",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2021-3618",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202107-216",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-395783",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2021-3618",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-395783"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-3618"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-019676"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-3618"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202107-216"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer. F5 Networks of nginx Products from other vendors contain vulnerabilities related to certificate validation.Information may be obtained and information may be tampered with. (CVE-2020-11724). ==========================================================================\nUbuntu Security Notice USN-5371-2\nApril 28, 2022\n\nnginx vulnerability\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 22.04 LTS\n\nSummary:\n\nnginx could be made to redirect network traffic. \n\nSoftware Description:\n- nginx: small, powerful, scalable web/proxy server\n\nDetails:\n\nUSN-5371-1 fixed several vulnerabilities in nginx. \nThis update provides the fix for CVE-2021-3618 for Ubuntu 22.04 LTS. \n\nOriginal advisory details:\n\n  It was discovered that nginx Lua module mishandled certain inputs. \n  An attacker could possibly use this issue to perform an HTTP Request\n  Smuggling attack. This issue only affects Ubuntu 18.04 LTS and\n  Ubuntu 20.04 LTS. (CVE-2020-11724)\n\n  It was discovered that nginx Lua module mishandled certain inputs. \n  An attacker could possibly use this issue to disclose sensitive\n  information. This issue only affects Ubuntu 18.04 LTS and\n  Ubuntu 20.04 LTS. (CVE-2020-36309)\n\n  It was discovered that nginx mishandled the use of\n  compatible certificates among multiple encryption protocols. \n  (CVE-2021-3618)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 22.04 LTS:\n   nginx-core                      1.18.0-6ubuntu14.1\n   nginx-extras                    1.18.0-6ubuntu14.1\n   nginx-light                     1.18.0-6ubuntu14.1\n\nIn general, a standard system update will make all the necessary changes. \n\nReferences:\n   https://ubuntu.com/security/notices/USN-5371-2\n   https://ubuntu.com/security/notices/USN-5371-1\n   CVE-2021-3618\n\nPackage Information:\n   https://launchpad.net/ubuntu/+source/nginx/1.18.0-6ubuntu14.1\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2021-3618"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-019676"
      },
      {
        "db": "VULHUB",
        "id": "VHN-395783"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-3618"
      },
      {
        "db": "PACKETSTORM",
        "id": "166709"
      },
      {
        "db": "PACKETSTORM",
        "id": "168672"
      },
      {
        "db": "PACKETSTORM",
        "id": "166888"
      },
      {
        "db": "PACKETSTORM",
        "id": "174729"
      }
    ],
    "trust": 2.16
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2021-3618",
        "trust": 3.8
      },
      {
        "db": "PACKETSTORM",
        "id": "168672",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-019676",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "166709",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "166888",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.6109",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.1628",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.6139",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022042817",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022010906",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022041422",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202107-216",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-395783",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-3618",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "174729",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-395783"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-3618"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-019676"
      },
      {
        "db": "PACKETSTORM",
        "id": "166709"
      },
      {
        "db": "PACKETSTORM",
        "id": "168672"
      },
      {
        "db": "PACKETSTORM",
        "id": "166888"
      },
      {
        "db": "PACKETSTORM",
        "id": "174729"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-3618"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202107-216"
      }
    ]
  },
  "id": "VAR-202107-1672",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-395783"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T10:58:31.706000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top\u00a0Page",
        "trust": 0.8,
        "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html"
      },
      {
        "title": "nginx Security vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=155955"
      },
      {
        "title": "Ubuntu Security Notice: USN-5371-3: nginx vulnerability",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-5371-3"
      },
      {
        "title": "Debian CVElist Bug Report Logs: nginx: CVE-2021-3618",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=ef1074892d0995f0a511641c443018df"
      },
      {
        "title": "Ubuntu Security Notice: USN-5371-2: nginx vulnerability",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-5371-2"
      },
      {
        "title": "Ubuntu Security Notice: USN-5371-1: nginx vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-5371-1"
      },
      {
        "title": "Amazon Linux 2: ALASNGINX1-2023-002",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=alasnginx1-2023-002"
      },
      {
        "title": "Red Hat: CVE-2021-3618",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=cve-2021-3618"
      },
      {
        "title": "Arch Linux Issues: ",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=cve-2021-3618 log"
      },
      {
        "title": "Amazon Linux 2022: ALAS2022-2022-172",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2022\u0026qid=alas2022-2022-172"
      },
      {
        "title": "Amazon Linux 2022: ALAS2022-2022-132",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2022\u0026qid=alas2022-2022-132"
      },
      {
        "title": "Amazon Linux 2022: ALAS2022-2022-171",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2022\u0026qid=alas2022-2022-171"
      },
      {
        "title": "Amazon Linux 2022: ALAS2022-2022-136",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2022\u0026qid=alas2022-2022-136"
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/live-hack-cve/cve-2021-3618 "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2021-3618"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-019676"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202107-216"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-295",
        "trust": 1.1
      },
      {
        "problemtype": "Illegal certificate verification (CWE-295) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-395783"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-019676"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-3618"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.6,
        "url": "https://alpaca-attack.com/"
      },
      {
        "trust": 1.8,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975623"
      },
      {
        "trust": 1.8,
        "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html"
      },
      {
        "trust": 1.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-3618"
      },
      {
        "trust": 0.6,
        "url": "https://ubuntu.com/security/cve-2021-3618"
      },
      {
        "trust": 0.6,
        "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991329"
      },
      {
        "trust": 0.6,
        "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991328"
      },
      {
        "trust": 0.6,
        "url": "https://github.com/nginx/nginx/commit/173f16f736c10eae46cd15dd861b04b82d91a37a"
      },
      {
        "trust": 0.6,
        "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991331"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022010906"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/support/pages/node/6489853"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022041422"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/nginx-man-in-the-middle-via-the-tls-extension-alpn-35818"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/168672/ubuntu-security-notice-usn-5371-3.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/support/pages/node/6514817"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2021-3618/"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022042817"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/166709/ubuntu-security-notice-usn-5371-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.1628"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.6109"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/166888/ubuntu-security-notice-usn-5371-2.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.6139"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-36309"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11724"
      },
      {
        "trust": 0.3,
        "url": "https://ubuntu.com/security/notices/usn-5371-1"
      },
      {
        "trust": 0.2,
        "url": "https://ubuntu.com/security/notices/usn-5371-3"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/295.html"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/live-hack-cve/cve-2021-3618"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.18.0-0ubuntu1.3"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.18.0-6ubuntu11.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.14.0-0ubuntu1.10"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.18.0-6ubuntu14.1"
      },
      {
        "trust": 0.1,
        "url": "https://ubuntu.com/security/notices/usn-5371-2"
      },
      {
        "trust": 0.1,
        "url": "https://ubuntu.com/security/notices/usn-6379-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/vsftpd/3.0.5-0ubuntu0.20.04.1"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-395783"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-3618"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-019676"
      },
      {
        "db": "PACKETSTORM",
        "id": "166709"
      },
      {
        "db": "PACKETSTORM",
        "id": "168672"
      },
      {
        "db": "PACKETSTORM",
        "id": "166888"
      },
      {
        "db": "PACKETSTORM",
        "id": "174729"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-3618"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202107-216"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-395783"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-3618"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-019676"
      },
      {
        "db": "PACKETSTORM",
        "id": "166709"
      },
      {
        "db": "PACKETSTORM",
        "id": "168672"
      },
      {
        "db": "PACKETSTORM",
        "id": "166888"
      },
      {
        "db": "PACKETSTORM",
        "id": "174729"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-3618"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202107-216"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-03-23T00:00:00",
        "db": "VULHUB",
        "id": "VHN-395783"
      },
      {
        "date": "2022-03-23T00:00:00",
        "db": "VULMON",
        "id": "CVE-2021-3618"
      },
      {
        "date": "2023-08-10T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2021-019676"
      },
      {
        "date": "2022-04-13T15:03:13",
        "db": "PACKETSTORM",
        "id": "166709"
      },
      {
        "date": "2022-10-10T16:13:35",
        "db": "PACKETSTORM",
        "id": "168672"
      },
      {
        "date": "2022-04-28T15:18:16",
        "db": "PACKETSTORM",
        "id": "166888"
      },
      {
        "date": "2023-09-19T15:23:43",
        "db": "PACKETSTORM",
        "id": "174729"
      },
      {
        "date": "2022-03-23T20:15:09.833000",
        "db": "NVD",
        "id": "CVE-2021-3618"
      },
      {
        "date": "2021-07-05T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202107-216"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-02-09T00:00:00",
        "db": "VULHUB",
        "id": "VHN-395783"
      },
      {
        "date": "2023-02-09T00:00:00",
        "db": "VULMON",
        "id": "CVE-2021-3618"
      },
      {
        "date": "2023-08-10T07:42:00",
        "db": "JVNDB",
        "id": "JVNDB-2021-019676"
      },
      {
        "date": "2023-02-09T02:03:34.457000",
        "db": "NVD",
        "id": "CVE-2021-3618"
      },
      {
        "date": "2023-05-19T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202107-216"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "168672"
      },
      {
        "db": "PACKETSTORM",
        "id": "174729"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202107-216"
      }
    ],
    "trust": 0.8
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "F5\u00a0Networks\u00a0 of \u00a0nginx\u00a0 Vulnerability related to certificate verification in products of multiple vendors",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-019676"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "trust management problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202107-216"
      }
    ],
    "trust": 0.6
  }
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "MDS-G4020-4XGS Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4020-4XGS Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4012-L3 Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4012-L3 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4012-L3-4XGS Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4012-L3-4XGS Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4028-L3 Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4028-L3 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "EDS-G508E Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "EDS-G508E Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4012-4XGS Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4012-4XGS Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4012 Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4012 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4028-4XGS Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4028-4XGS Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "EDS-G516E Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "EDS-G516E Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4028-L3-4XGS Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4028-L3-4XGS Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4020 Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4020 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4028 Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4028 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "EDS-G512E Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "EDS-G512E Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4020-L3-4XGS Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4020-L3-4XGS Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4020-L3 Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4020-L3 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2021-3618",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3618"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2023-48795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48795"
    },
    {
      "name": "CVE-2019-20372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-20372"
    },
    {
      "name": "CVE-2021-23017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23017"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0940",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-11-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Moxa. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Moxa",
  "vendor_advisories": [
    {
      "published_at": "2024-11-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Moxa mpsa-241044",
      "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241044-vulnerabilities-identified-in-mds-g4028-l3-series-and-eds-g512e"
    },
    {
      "published_at": "2024-11-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Moxa mpsa-244252",
      "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-244252-multiple-moxa-ethernet-switches-affected-by-cve-2023-48795-and-cve-2019-20372"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "MDS-G4020-4XGS Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4020-4XGS Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4012-L3 Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4012-L3 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4012-L3-4XGS Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4012-L3-4XGS Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4028-L3 Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4028-L3 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "EDS-G508E Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "EDS-G508E Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4012-4XGS Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4012-4XGS Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4012 Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4012 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4028-4XGS Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4028-4XGS Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "EDS-G516E Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "EDS-G516E Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4028-L3-4XGS Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4028-L3-4XGS Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4020 Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4020 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4028 Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4028 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "EDS-G512E Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "EDS-G512E Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4020-L3-4XGS Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4020-L3-4XGS Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MDS-G4020-L3 Series sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "MDS-G4020-L3 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2021-3618",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3618"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2023-48795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48795"
    },
    {
      "name": "CVE-2019-20372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-20372"
    },
    {
      "name": "CVE-2021-23017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23017"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0940",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-11-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Moxa. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Moxa",
  "vendor_advisories": [
    {
      "published_at": "2024-11-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Moxa mpsa-241044",
      "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241044-vulnerabilities-identified-in-mds-g4028-l3-series-and-eds-g512e"
    },
    {
      "published_at": "2024-11-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Moxa mpsa-244252",
      "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-244252-multiple-moxa-ethernet-switches-affected-by-cve-2023-48795-and-cve-2019-20372"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Junos OS versions ant\u00e9rieures \u00e0 21.2R3-S1, 21.2R3-S7, 21.2R3-S8, 21.3R3, 21.3R3-S1, 21.4R2, 21.4R3, 21.4R3-S6, 21.4R3-S7, 21.4R3-S8, 21.4R3-S9, 22.1R1, 22.1R2, 22.1R3-S5, 22.1R3-S6, 22.2R1-S2, 22.2R2, 22.2R3-S3, 22.2R3-S4, 22.2R3-S5, 22.3R1, 22.3R3-S2, 22.3R3-S3, 22.3R3-S4, 22.4R3, 22.4R3-S2, 22.4R3-S3, 22.4R3-S4, 23.2R1, 23.2R2, 23.2R2-S1, 23.2R2-S2, 23.4R1, 23.4R1-S2, 23.4R2, 23.4R2-S1, 24.1R1, 24.2R1, 24.2R1-S1 et 24.2R2",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS Evolved versions ant\u00e9rieures \u00e0 20.4R3-S9-EVO, 21.2R3-S7-EVO, 21.2R3-S8-EVO, 21.3R3-S5-EVO, 21.4R3-S5-EVO, 21.4R3-S7-EVO, 21.4R3-S8-EVO, 21.4R3-S9-EVO, 22.1R3-S5-EVO, 22.1R3-S6-EVO, 22.2R3-EVO, 22.2R3-S3-EVO, 22.2R3-S4-EVO, 22.3R3-EVO, 22.3R3-S2-EVO, 22.3R3-S3-EVO, 22.3R3-S4-EVO, 22.4R2-EVO, 22.4R3-EVO, 22.4R3-S1-EVO, 22.4R3-S2-EVO, 22.4R3-S3-EVO, 23.2R1-EVO, 23.2R1-S2-EVO, 23.2R2-EVO, 23.2R2-S1-EVO, 23.2R2-S2-EVO, 23.4R1-EVO, 23.4R1-S1-EVO, 23.4R1-S2-EVO, 23.4R2-EVO, 23.4R2-S1-EVO, 24.2R1-EVO, 24.2R1-EVO et 24.2R2-EVO",
      "product": {
        "name": "Junos OS Evolved",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos Space 24.1R1 sans le correctif de s\u00e9curit\u00e9 Patch V1 et V2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "Les versions suivantes de Junos OS et Junos OS Evolved sont \u00e0 para\u00eetre : 22.2R3-S5, 22.3R3-S4, 24.2R2, 24.4R1, 22.2R3-S5-EVO, 22.3R3-S4-EVO, 24.2R2-EVO et 24.4R1-EVO",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2016-1247",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-1247"
    },
    {
      "name": "CVE-2024-47501",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47501"
    },
    {
      "name": "CVE-2024-47496",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47496"
    },
    {
      "name": "CVE-2023-51385",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51385"
    },
    {
      "name": "CVE-2024-47493",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47493"
    },
    {
      "name": "CVE-2024-39515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39515"
    },
    {
      "name": "CVE-2021-3618",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3618"
    },
    {
      "name": "CVE-2023-31124",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31124"
    },
    {
      "name": "CVE-2023-3823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3823"
    },
    {
      "name": "CVE-2023-32067",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32067"
    },
    {
      "name": "CVE-2024-39525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39525"
    },
    {
      "name": "CVE-2024-47498",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47498"
    },
    {
      "name": "CVE-2016-0746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-0746"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2017-20005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-20005"
    },
    {
      "name": "CVE-2024-39544",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39544"
    },
    {
      "name": "CVE-2016-4450",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-4450"
    },
    {
      "name": "CVE-2023-0568",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0568"
    },
    {
      "name": "CVE-2024-47489",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47489"
    },
    {
      "name": "CVE-2022-41741",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41741"
    },
    {
      "name": "CVE-2024-47494",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47494"
    },
    {
      "name": "CVE-2024-39534",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39534"
    },
    {
      "name": "CVE-2024-47499",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47499"
    },
    {
      "name": "CVE-2022-41742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41742"
    },
    {
      "name": "CVE-2024-39526",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39526"
    },
    {
      "name": "CVE-2024-39547",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39547"
    },
    {
      "name": "CVE-2023-31147",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31147"
    },
    {
      "name": "CVE-2024-47495",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47495"
    },
    {
      "name": "CVE-2019-20372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-20372"
    },
    {
      "name": "CVE-2016-0747",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-0747"
    },
    {
      "name": "CVE-2021-23017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23017"
    },
    {
      "name": "CVE-2024-47490",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47490"
    },
    {
      "name": "CVE-2018-16845",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-16845"
    },
    {
      "name": "CVE-2024-47491",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47491"
    },
    {
      "name": "CVE-2017-7529",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-7529"
    },
    {
      "name": "CVE-2024-39527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39527"
    },
    {
      "name": "CVE-2024-39563",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39563"
    },
    {
      "name": "CVE-2024-47502",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47502"
    },
    {
      "name": "CVE-2024-39516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39516"
    },
    {
      "name": "CVE-2024-47503",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47503"
    },
    {
      "name": "CVE-2023-0567",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0567"
    },
    {
      "name": "CVE-2024-47506",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47506"
    },
    {
      "name": "CVE-2023-0662",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0662"
    },
    {
      "name": "CVE-2024-4741",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-4741"
    },
    {
      "name": "CVE-2016-0742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-0742"
    },
    {
      "name": "CVE-2024-47504",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47504"
    },
    {
      "name": "CVE-2023-3824",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3824"
    },
    {
      "name": "CVE-2023-31130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31130"
    },
    {
      "name": "CVE-2024-2511",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-2511"
    },
    {
      "name": "CVE-2024-47507",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47507"
    },
    {
      "name": "CVE-2024-47497",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47497"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0866",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-10-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Juniper Networks. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Juniper Networks",
  "vendor_advisories": [
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88112",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-Multiple-vulnerabilities-resolved-in-c-ares-1-18-1"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88121",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Due-to-a-race-condition-AgentD-process-causes-a-memory-corruption-and-FPC-reset-CVE-2024-47494"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88104",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-SRX-Series-Low-privileged-user-able-to-access-sensitive-information-on-file-system-CVE-2024-39527"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88107",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Multiple-vulnerabilities-resolved-in-OpenSSL"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88105",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-Connections-to-the-network-and-broadcast-address-accepted-CVE-2024-39534"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88134",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-SRX5000-Series-Receipt-of-a-specific-malformed-packet-will-cause-a-flowd-crash-CVE-2024-47504"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88123",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-MX-Series-The-PFE-will-crash-on-running-specific-command-CVE-2024-47496"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88128",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-QFX5000-Series-Configured-MAC-learning-and-move-limits-are-not-in-effect-CVE-2024-47498"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88106",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-Low-privileged-local-user-able-to-view-NETCONF-traceoptions-files-CVE-2024-39544"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88136",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-Specific-low-privileged-CLI-commands-and-SNMP-GET-requests-can-trigger-a-resource-leak"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88110",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-Space-Remote-Command-Execution-RCE-vulnerability-in-web-application-CVE-2024-39563"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88122",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-In-a-dual-RE-scenario-a-locally-authenticated-attacker-with-shell-privileges-can-take-over-the-device-CVE-2024-47495"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88124",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-SRX-Series-QFX-Series-MX-Series-and-EX-Series-Receiving-specific-HTTPS-traffic-causes-resource-exhaustion-CVE-2024-47497"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88111",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-ACX-Series-Receipt-of-specific-transit-protocol-packets-is-incorrectly-processed-by-the-RE-CVE-2024-47489"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88108",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-cRPD-Receipt-of-crafted-TCP-traffic-can-trigger-high-CPU-utilization-CVE-2024-39547"
    },
    {
      "published_at": "2024-10-16",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88100",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Junos-OS-and-Junos-OS-Evolved-Receipt-of-a-specifically-malformed-BGP-packet-causes-RPD-crash-when-segment-routing-is-enabled-CVE-2024-39516"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88131",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-MX304-MX-with-MPC10-11-LC9600-and-EX9200-with-EX9200-15C-In-a-VPLS-or-Junos-Fusion-scenario-specific-show-commands-cause-an-FPC-crash-CVE-2024-47501"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88099",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-With-BGP-traceoptions-enabled-receipt-of-specially-crafted-BGP-update-causes-RPD-crash-CVE-2024-39515"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88135",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Multiple-vulnerabilities-in-OSS-component-nginx-resolved"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88102",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-When-BGP-nexthop-traceoptions-is-enabled-receipt-of-specially-crafted-BGP-packet-causes-RPD-crash-CVE-2024-39525"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88116",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Receipt-of-a-specific-malformed-BGP-path-attribute-leads-to-an-RPD-crash-CVE-2024-47491"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88097",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-Space-OS-command-injection-vulnerability-in-OpenSSH-CVE-2023-51385"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88133",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-SRX4600-and-SRX5000-Series-Sequence-of-specific-PIM-packets-causes-a-flowd-crash-CVE-2024-47503"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88137",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-SRX-Series-A-large-amount-of-traffic-being-processed-by-ATP-Cloud-can-lead-to-a-PFE-crash-CVE-2024-47506"
    },
    {
      "published_at": "2024-10-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88119",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-SRX5K-SRX4600-and-MX-Series-Trio-based-FPCs-Continuous-physical-interface-flaps-causes-local-FPC-to-crash-CVE-2024-47493"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88103",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-MX-Series-with-MPC10-MPC11-LC9600-MX304-EX9200-PTX-Series-Receipt-of-malformed-DHCP-packets-causes-interfaces-to-stop-processing-packets-CVE-2024-39526"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88138",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-BGP-update-message-containing-aggregator-attribute-with-an-ASN-value-of-zero-0-is-accepted-CVE-2024-47507"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88129",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-In-a-BMP-scenario-receipt-of-a-malformed-AS-PATH-attribute-can-cause-an-RPD-core-CVE-2024-47499"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88115",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-ACX-7000-Series-Receipt-of-specific-transit-MPLS-packets-causes-resources-to-be-exhausted-CVE-2024-47490"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88120",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-J-Web-Multiple-vulnerabilities-resolved-in-PHP-software"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88132",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-TCP-session-state-is-not-always-cleared-on-the-Routing-Engine-CVE-2024-47502"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Junos OS versions ant\u00e9rieures \u00e0 21.2R3-S1, 21.2R3-S7, 21.2R3-S8, 21.3R3, 21.3R3-S1, 21.4R2, 21.4R3, 21.4R3-S6, 21.4R3-S7, 21.4R3-S8, 21.4R3-S9, 22.1R1, 22.1R2, 22.1R3-S5, 22.1R3-S6, 22.2R1-S2, 22.2R2, 22.2R3-S3, 22.2R3-S4, 22.2R3-S5, 22.3R1, 22.3R3-S2, 22.3R3-S3, 22.3R3-S4, 22.4R3, 22.4R3-S2, 22.4R3-S3, 22.4R3-S4, 23.2R1, 23.2R2, 23.2R2-S1, 23.2R2-S2, 23.4R1, 23.4R1-S2, 23.4R2, 23.4R2-S1, 24.1R1, 24.2R1, 24.2R1-S1 et 24.2R2",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS Evolved versions ant\u00e9rieures \u00e0 20.4R3-S9-EVO, 21.2R3-S7-EVO, 21.2R3-S8-EVO, 21.3R3-S5-EVO, 21.4R3-S5-EVO, 21.4R3-S7-EVO, 21.4R3-S8-EVO, 21.4R3-S9-EVO, 22.1R3-S5-EVO, 22.1R3-S6-EVO, 22.2R3-EVO, 22.2R3-S3-EVO, 22.2R3-S4-EVO, 22.3R3-EVO, 22.3R3-S2-EVO, 22.3R3-S3-EVO, 22.3R3-S4-EVO, 22.4R2-EVO, 22.4R3-EVO, 22.4R3-S1-EVO, 22.4R3-S2-EVO, 22.4R3-S3-EVO, 23.2R1-EVO, 23.2R1-S2-EVO, 23.2R2-EVO, 23.2R2-S1-EVO, 23.2R2-S2-EVO, 23.4R1-EVO, 23.4R1-S1-EVO, 23.4R1-S2-EVO, 23.4R2-EVO, 23.4R2-S1-EVO, 24.2R1-EVO, 24.2R1-EVO et 24.2R2-EVO",
      "product": {
        "name": "Junos OS Evolved",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos Space 24.1R1 sans le correctif de s\u00e9curit\u00e9 Patch V1 et V2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "Les versions suivantes de Junos OS et Junos OS Evolved sont \u00e0 para\u00eetre : 22.2R3-S5, 22.3R3-S4, 24.2R2, 24.4R1, 22.2R3-S5-EVO, 22.3R3-S4-EVO, 24.2R2-EVO et 24.4R1-EVO",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2016-1247",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-1247"
    },
    {
      "name": "CVE-2024-47501",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47501"
    },
    {
      "name": "CVE-2024-47496",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47496"
    },
    {
      "name": "CVE-2023-51385",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51385"
    },
    {
      "name": "CVE-2024-47493",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47493"
    },
    {
      "name": "CVE-2024-39515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39515"
    },
    {
      "name": "CVE-2021-3618",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3618"
    },
    {
      "name": "CVE-2023-31124",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31124"
    },
    {
      "name": "CVE-2023-3823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3823"
    },
    {
      "name": "CVE-2023-32067",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32067"
    },
    {
      "name": "CVE-2024-39525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39525"
    },
    {
      "name": "CVE-2024-47498",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47498"
    },
    {
      "name": "CVE-2016-0746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-0746"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2017-20005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-20005"
    },
    {
      "name": "CVE-2024-39544",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39544"
    },
    {
      "name": "CVE-2016-4450",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-4450"
    },
    {
      "name": "CVE-2023-0568",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0568"
    },
    {
      "name": "CVE-2024-47489",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47489"
    },
    {
      "name": "CVE-2022-41741",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41741"
    },
    {
      "name": "CVE-2024-47494",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47494"
    },
    {
      "name": "CVE-2024-39534",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39534"
    },
    {
      "name": "CVE-2024-47499",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47499"
    },
    {
      "name": "CVE-2022-41742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41742"
    },
    {
      "name": "CVE-2024-39526",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39526"
    },
    {
      "name": "CVE-2024-39547",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39547"
    },
    {
      "name": "CVE-2023-31147",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31147"
    },
    {
      "name": "CVE-2024-47495",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47495"
    },
    {
      "name": "CVE-2019-20372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-20372"
    },
    {
      "name": "CVE-2016-0747",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-0747"
    },
    {
      "name": "CVE-2021-23017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23017"
    },
    {
      "name": "CVE-2024-47490",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47490"
    },
    {
      "name": "CVE-2018-16845",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-16845"
    },
    {
      "name": "CVE-2024-47491",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47491"
    },
    {
      "name": "CVE-2017-7529",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-7529"
    },
    {
      "name": "CVE-2024-39527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39527"
    },
    {
      "name": "CVE-2024-39563",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39563"
    },
    {
      "name": "CVE-2024-47502",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47502"
    },
    {
      "name": "CVE-2024-39516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39516"
    },
    {
      "name": "CVE-2024-47503",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47503"
    },
    {
      "name": "CVE-2023-0567",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0567"
    },
    {
      "name": "CVE-2024-47506",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47506"
    },
    {
      "name": "CVE-2023-0662",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0662"
    },
    {
      "name": "CVE-2024-4741",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-4741"
    },
    {
      "name": "CVE-2016-0742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-0742"
    },
    {
      "name": "CVE-2024-47504",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47504"
    },
    {
      "name": "CVE-2023-3824",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3824"
    },
    {
      "name": "CVE-2023-31130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31130"
    },
    {
      "name": "CVE-2024-2511",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-2511"
    },
    {
      "name": "CVE-2024-47507",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47507"
    },
    {
      "name": "CVE-2024-47497",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47497"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0866",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-10-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Juniper Networks. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Juniper Networks",
  "vendor_advisories": [
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88112",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-Multiple-vulnerabilities-resolved-in-c-ares-1-18-1"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88121",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Due-to-a-race-condition-AgentD-process-causes-a-memory-corruption-and-FPC-reset-CVE-2024-47494"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88104",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-SRX-Series-Low-privileged-user-able-to-access-sensitive-information-on-file-system-CVE-2024-39527"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88107",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Multiple-vulnerabilities-resolved-in-OpenSSL"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88105",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-Connections-to-the-network-and-broadcast-address-accepted-CVE-2024-39534"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88134",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-SRX5000-Series-Receipt-of-a-specific-malformed-packet-will-cause-a-flowd-crash-CVE-2024-47504"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88123",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-MX-Series-The-PFE-will-crash-on-running-specific-command-CVE-2024-47496"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88128",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-QFX5000-Series-Configured-MAC-learning-and-move-limits-are-not-in-effect-CVE-2024-47498"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88106",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-Low-privileged-local-user-able-to-view-NETCONF-traceoptions-files-CVE-2024-39544"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88136",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-Specific-low-privileged-CLI-commands-and-SNMP-GET-requests-can-trigger-a-resource-leak"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88110",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-Space-Remote-Command-Execution-RCE-vulnerability-in-web-application-CVE-2024-39563"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88122",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-In-a-dual-RE-scenario-a-locally-authenticated-attacker-with-shell-privileges-can-take-over-the-device-CVE-2024-47495"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88124",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-SRX-Series-QFX-Series-MX-Series-and-EX-Series-Receiving-specific-HTTPS-traffic-causes-resource-exhaustion-CVE-2024-47497"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88111",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-ACX-Series-Receipt-of-specific-transit-protocol-packets-is-incorrectly-processed-by-the-RE-CVE-2024-47489"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88108",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-cRPD-Receipt-of-crafted-TCP-traffic-can-trigger-high-CPU-utilization-CVE-2024-39547"
    },
    {
      "published_at": "2024-10-16",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88100",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Junos-OS-and-Junos-OS-Evolved-Receipt-of-a-specifically-malformed-BGP-packet-causes-RPD-crash-when-segment-routing-is-enabled-CVE-2024-39516"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88131",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-MX304-MX-with-MPC10-11-LC9600-and-EX9200-with-EX9200-15C-In-a-VPLS-or-Junos-Fusion-scenario-specific-show-commands-cause-an-FPC-crash-CVE-2024-47501"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88099",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-With-BGP-traceoptions-enabled-receipt-of-specially-crafted-BGP-update-causes-RPD-crash-CVE-2024-39515"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88135",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Multiple-vulnerabilities-in-OSS-component-nginx-resolved"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88102",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-When-BGP-nexthop-traceoptions-is-enabled-receipt-of-specially-crafted-BGP-packet-causes-RPD-crash-CVE-2024-39525"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88116",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Receipt-of-a-specific-malformed-BGP-path-attribute-leads-to-an-RPD-crash-CVE-2024-47491"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88097",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-Space-OS-command-injection-vulnerability-in-OpenSSH-CVE-2023-51385"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88133",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-SRX4600-and-SRX5000-Series-Sequence-of-specific-PIM-packets-causes-a-flowd-crash-CVE-2024-47503"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88137",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-SRX-Series-A-large-amount-of-traffic-being-processed-by-ATP-Cloud-can-lead-to-a-PFE-crash-CVE-2024-47506"
    },
    {
      "published_at": "2024-10-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88119",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-SRX5K-SRX4600-and-MX-Series-Trio-based-FPCs-Continuous-physical-interface-flaps-causes-local-FPC-to-crash-CVE-2024-47493"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88103",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-MX-Series-with-MPC10-MPC11-LC9600-MX304-EX9200-PTX-Series-Receipt-of-malformed-DHCP-packets-causes-interfaces-to-stop-processing-packets-CVE-2024-39526"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88138",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-BGP-update-message-containing-aggregator-attribute-with-an-ASN-value-of-zero-0-is-accepted-CVE-2024-47507"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88129",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-In-a-BMP-scenario-receipt-of-a-malformed-AS-PATH-attribute-can-cause-an-RPD-core-CVE-2024-47499"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88115",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-ACX-7000-Series-Receipt-of-specific-transit-MPLS-packets-causes-resources-to-be-exhausted-CVE-2024-47490"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88120",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-J-Web-Multiple-vulnerabilities-resolved-in-PHP-software"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA88132",
      "url": "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-TCP-session-state-is-not-always-cleared-on-the-Routing-Engine-CVE-2024-47502"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for vsftpd",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for vsftpd fixes the following issues:\n\n- CVE-2021-3618: Enforced security checks against ALPACA attack (PM-3322, jsc#SLE-23895, bsc#1187686, bsc#1187678).\n- Added hardening to systemd services (bsc#1181400).\n\nBugfixes:\n- Fixed a seccomp failure in FIPS mode when SSL was enabled (bsc#1052900).\n- Allowed wait4() to be called so that the broker can wait for its child processes (bsc#1021387).\n- Fixed hang when using seccomp and syslog (bsc#971784).\n- Allowed sendto() syscall when /dev/log support is enabled (bsc#786024).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2022-3458,SUSE-SLE-Product-HPC-15-2022-3458,SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3458,SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3458,SUSE-SLE-Product-SLES-15-2022-3458,SUSE-SLE-Product-SLES-15-SP1-BCL-2022-3458,SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-3458,SUSE-SLE-Product-SLES_SAP-15-2022-3458,SUSE-SLE-Product-SLES_SAP-15-SP1-2022-3458,SUSE-Storage-6-2022-3458",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_3458-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2022:3458-1",
        "url": "https://www.suse.com/support/update/announcement/2022/suse-su-20223458-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2022:3458-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-September/012444.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1021387",
        "url": "https://bugzilla.suse.com/1021387"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1052900",
        "url": "https://bugzilla.suse.com/1052900"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1181400",
        "url": "https://bugzilla.suse.com/1181400"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187678",
        "url": "https://bugzilla.suse.com/1187678"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187686",
        "url": "https://bugzilla.suse.com/1187686"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 786024",
        "url": "https://bugzilla.suse.com/786024"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 971784",
        "url": "https://bugzilla.suse.com/971784"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-3618 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-3618/"
      }
    ],
    "title": "Security update for vsftpd",
    "tracking": {
      "current_release_date": "2022-09-28T15:13:09Z",
      "generator": {
        "date": "2022-09-28T15:13:09Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2022:3458-1",
      "initial_release_date": "2022-09-28T15:13:09Z",
      "revision_history": [
        {
          "date": "2022-09-28T15:13:09Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-150000.7.19.1.aarch64",
                "product": {
                  "name": "vsftpd-3.0.5-150000.7.19.1.aarch64",
                  "product_id": "vsftpd-3.0.5-150000.7.19.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-150000.7.19.1.i586",
                "product": {
                  "name": "vsftpd-3.0.5-150000.7.19.1.i586",
                  "product_id": "vsftpd-3.0.5-150000.7.19.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-150000.7.19.1.ppc64le",
                "product": {
                  "name": "vsftpd-3.0.5-150000.7.19.1.ppc64le",
                  "product_id": "vsftpd-3.0.5-150000.7.19.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-150000.7.19.1.s390x",
                "product": {
                  "name": "vsftpd-3.0.5-150000.7.19.1.s390x",
                  "product_id": "vsftpd-3.0.5-150000.7.19.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-150000.7.19.1.x86_64",
                "product": {
                  "name": "vsftpd-3.0.5-150000.7.19.1.x86_64",
                  "product_id": "vsftpd-3.0.5-150000.7.19.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP1-BCL",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP1-BCL",
                  "product_id": "SUSE Linux Enterprise Server 15 SP1-BCL",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_bcl:15:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP1-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP1-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP1",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP1",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Enterprise Storage 6",
                "product": {
                  "name": "SUSE Enterprise Storage 6",
                  "product_id": "SUSE Enterprise Storage 6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:ses:6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15-ESPOS:vsftpd-3.0.5-150000.7.19.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15-ESPOS:vsftpd-3.0.5-150000.7.19.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:vsftpd-3.0.5-150000.7.19.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:vsftpd-3.0.5-150000.7.19.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.aarch64 as component of SUSE Linux Enterprise Server 15-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.ppc64le as component of SUSE Linux Enterprise Server 15-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.s390x as component of SUSE Linux Enterprise Server 15-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.s390x"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.x86_64 as component of SUSE Linux Enterprise Server 15-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP1-BCL",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-BCL:vsftpd-3.0.5-150000.7.19.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.s390x as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.s390x"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15:vsftpd-3.0.5-150000.7.19.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15:vsftpd-3.0.5-150000.7.19.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:vsftpd-3.0.5-150000.7.19.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:vsftpd-3.0.5-150000.7.19.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.aarch64 as component of SUSE Enterprise Storage 6",
          "product_id": "SUSE Enterprise Storage 6:vsftpd-3.0.5-150000.7.19.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.aarch64",
        "relates_to_product_reference": "SUSE Enterprise Storage 6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150000.7.19.1.x86_64 as component of SUSE Enterprise Storage 6",
          "product_id": "SUSE Enterprise Storage 6:vsftpd-3.0.5-150000.7.19.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150000.7.19.1.x86_64",
        "relates_to_product_reference": "SUSE Enterprise Storage 6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3618",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-3618"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 6:vsftpd-3.0.5-150000.7.19.1.aarch64",
          "SUSE Enterprise Storage 6:vsftpd-3.0.5-150000.7.19.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:vsftpd-3.0.5-150000.7.19.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:vsftpd-3.0.5-150000.7.19.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15-ESPOS:vsftpd-3.0.5-150000.7.19.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15-ESPOS:vsftpd-3.0.5-150000.7.19.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP1-BCL:vsftpd-3.0.5-150000.7.19.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.s390x",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64",
          "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64",
          "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.ppc64le",
          "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.s390x",
          "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:vsftpd-3.0.5-150000.7.19.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:vsftpd-3.0.5-150000.7.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15:vsftpd-3.0.5-150000.7.19.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15:vsftpd-3.0.5-150000.7.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-3618",
          "url": "https://www.suse.com/security/cve/CVE-2021-3618"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187678 for CVE-2021-3618",
          "url": "https://bugzilla.suse.com/1187678"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 6:vsftpd-3.0.5-150000.7.19.1.aarch64",
            "SUSE Enterprise Storage 6:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:vsftpd-3.0.5-150000.7.19.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15-ESPOS:vsftpd-3.0.5-150000.7.19.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15-ESPOS:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-BCL:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64",
            "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.ppc64le",
            "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.s390x",
            "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:vsftpd-3.0.5-150000.7.19.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15:vsftpd-3.0.5-150000.7.19.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15:vsftpd-3.0.5-150000.7.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Enterprise Storage 6:vsftpd-3.0.5-150000.7.19.1.aarch64",
            "SUSE Enterprise Storage 6:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:vsftpd-3.0.5-150000.7.19.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15-ESPOS:vsftpd-3.0.5-150000.7.19.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15-ESPOS:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-BCL:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.aarch64",
            "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.ppc64le",
            "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.s390x",
            "SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:vsftpd-3.0.5-150000.7.19.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:vsftpd-3.0.5-150000.7.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15:vsftpd-3.0.5-150000.7.19.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15:vsftpd-3.0.5-150000.7.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-09-28T15:13:09Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-3618"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for vsftpd",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for vsftpd fixes the following issues:\n\n- CVE-2021-3618: Enforced security checks against ALPACA attack (bsc#1187678, bsc#1187686, PM-3322).\n\nBugfixes:\n- Fixed a seccomp failure in FIPS mode when SSL was enabled (bsc#1052900).\n- Allowed wait4() to be called so that the broker can wait for its child processes (bsc#1021387).\n- Allowed sendto() syscall when /dev/log support is enabled (bsc#786024).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2022-3320,SUSE-SLE-Module-Server-Applications-15-SP4-2022-3320,openSUSE-SLE-15.4-2022-3320",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_3320-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2022:3320-1",
        "url": "https://www.suse.com/support/update/announcement/2022/suse-su-20223320-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2022:3320-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-September/012296.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1021387",
        "url": "https://bugzilla.suse.com/1021387"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1052900",
        "url": "https://bugzilla.suse.com/1052900"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187678",
        "url": "https://bugzilla.suse.com/1187678"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187686",
        "url": "https://bugzilla.suse.com/1187686"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 786024",
        "url": "https://bugzilla.suse.com/786024"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-3618 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-3618/"
      }
    ],
    "title": "Security update for vsftpd",
    "tracking": {
      "current_release_date": "2022-09-20T12:47:13Z",
      "generator": {
        "date": "2022-09-20T12:47:13Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2022:3320-1",
      "initial_release_date": "2022-09-20T12:47:13Z",
      "revision_history": [
        {
          "date": "2022-09-20T12:47:13Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-150400.3.3.1.aarch64",
                "product": {
                  "name": "vsftpd-3.0.5-150400.3.3.1.aarch64",
                  "product_id": "vsftpd-3.0.5-150400.3.3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-150400.3.3.1.i586",
                "product": {
                  "name": "vsftpd-3.0.5-150400.3.3.1.i586",
                  "product_id": "vsftpd-3.0.5-150400.3.3.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-150400.3.3.1.ppc64le",
                "product": {
                  "name": "vsftpd-3.0.5-150400.3.3.1.ppc64le",
                  "product_id": "vsftpd-3.0.5-150400.3.3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-150400.3.3.1.s390x",
                "product": {
                  "name": "vsftpd-3.0.5-150400.3.3.1.s390x",
                  "product_id": "vsftpd-3.0.5-150400.3.3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-150400.3.3.1.x86_64",
                "product": {
                  "name": "vsftpd-3.0.5-150400.3.3.1.x86_64",
                  "product_id": "vsftpd-3.0.5-150400.3.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Server Applications 15 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Server Applications 15 SP4",
                  "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-server-applications:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.4",
                "product": {
                  "name": "openSUSE Leap 15.4",
                  "product_id": "openSUSE Leap 15.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150400.3.3.1.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-150400.3.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150400.3.3.1.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-150400.3.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150400.3.3.1.s390x as component of SUSE Linux Enterprise Module for Server Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.s390x"
        },
        "product_reference": "vsftpd-3.0.5-150400.3.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150400.3.3.1.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150400.3.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150400.3.3.1.aarch64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-150400.3.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150400.3.3.1.ppc64le as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-150400.3.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150400.3.3.1.s390x as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.s390x"
        },
        "product_reference": "vsftpd-3.0.5-150400.3.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150400.3.3.1.x86_64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150400.3.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3618",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-3618"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.x86_64",
          "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.aarch64",
          "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.ppc64le",
          "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.s390x",
          "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-3618",
          "url": "https://www.suse.com/security/cve/CVE-2021-3618"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187678 for CVE-2021-3618",
          "url": "https://bugzilla.suse.com/1187678"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.x86_64",
            "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.aarch64",
            "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.ppc64le",
            "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.s390x",
            "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP4:vsftpd-3.0.5-150400.3.3.1.x86_64",
            "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.aarch64",
            "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.ppc64le",
            "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.s390x",
            "openSUSE Leap 15.4:vsftpd-3.0.5-150400.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-09-20T12:47:13Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-3618"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for vsftpd",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for vsftpd fixes the following issues:\n\n- CVE-2021-3618: Enforced security checks against ALPACA attack (PM-3322, jsc#SLE-23896, bsc#1187686, bsc#1187678).\n- Added hardening to systemd services (bsc#1181400).\n\nBugfixes:\n- Fixed a seccomp failure in FIPS mode when SSL was enabled (bsc#1052900).\n- Allowed wait4() to be called so that the broker can wait for its child processes (bsc#1021387).\n- Fixed hang when using seccomp and syslog (bsc#971784).\n- Allowed sendto() syscall when /dev/log support is enabled (bsc#786024).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2022-3457,SUSE-SLE-Module-Server-Applications-15-SP3-2022-3457,SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-3457,SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-3457,SUSE-SLE-Product-SLES-15-SP2-BCL-2022-3457,SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-3457,SUSE-SLE-Product-SLES_SAP-15-SP2-2022-3457,SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-3457,SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-3457,SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-3457,SUSE-Storage-7-2022-3457,openSUSE-SLE-15.3-2022-3457",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_3457-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2022:3457-1",
        "url": "https://www.suse.com/support/update/announcement/2022/suse-su-20223457-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2022:3457-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-September/012443.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1021387",
        "url": "https://bugzilla.suse.com/1021387"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1052900",
        "url": "https://bugzilla.suse.com/1052900"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1181400",
        "url": "https://bugzilla.suse.com/1181400"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187678",
        "url": "https://bugzilla.suse.com/1187678"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187686",
        "url": "https://bugzilla.suse.com/1187686"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 786024",
        "url": "https://bugzilla.suse.com/786024"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 971784",
        "url": "https://bugzilla.suse.com/971784"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-3618 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-3618/"
      }
    ],
    "title": "Security update for vsftpd",
    "tracking": {
      "current_release_date": "2022-09-28T15:11:47Z",
      "generator": {
        "date": "2022-09-28T15:11:47Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2022:3457-1",
      "initial_release_date": "2022-09-28T15:11:47Z",
      "revision_history": [
        {
          "date": "2022-09-28T15:11:47Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-150200.12.9.1.aarch64",
                "product": {
                  "name": "vsftpd-3.0.5-150200.12.9.1.aarch64",
                  "product_id": "vsftpd-3.0.5-150200.12.9.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-150200.12.9.1.i586",
                "product": {
                  "name": "vsftpd-3.0.5-150200.12.9.1.i586",
                  "product_id": "vsftpd-3.0.5-150200.12.9.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-150200.12.9.1.ppc64le",
                "product": {
                  "name": "vsftpd-3.0.5-150200.12.9.1.ppc64le",
                  "product_id": "vsftpd-3.0.5-150200.12.9.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-150200.12.9.1.s390x",
                "product": {
                  "name": "vsftpd-3.0.5-150200.12.9.1.s390x",
                  "product_id": "vsftpd-3.0.5-150200.12.9.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-150200.12.9.1.x86_64",
                "product": {
                  "name": "vsftpd-3.0.5-150200.12.9.1.x86_64",
                  "product_id": "vsftpd-3.0.5-150200.12.9.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Server Applications 15 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Server Applications 15 SP3",
                  "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-server-applications:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP2-BCL",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP2-BCL",
                  "product_id": "SUSE Linux Enterprise Server 15 SP2-BCL",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_bcl:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Manager Proxy 4.1",
                "product": {
                  "name": "SUSE Manager Proxy 4.1",
                  "product_id": "SUSE Manager Proxy 4.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-proxy:4.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Manager Retail Branch Server 4.1",
                "product": {
                  "name": "SUSE Manager Retail Branch Server 4.1",
                  "product_id": "SUSE Manager Retail Branch Server 4.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-retail-branch-server:4.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Manager Server 4.1",
                "product": {
                  "name": "SUSE Manager Server 4.1",
                  "product_id": "SUSE Manager Server 4.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-server:4.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Enterprise Storage 7",
                "product": {
                  "name": "SUSE Enterprise Storage 7",
                  "product_id": "SUSE Enterprise Storage 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:ses:7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.3",
                "product": {
                  "name": "openSUSE Leap 15.3",
                  "product_id": "openSUSE Leap 15.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.s390x as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.s390x"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:vsftpd-3.0.5-150200.12.9.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:vsftpd-3.0.5-150200.12.9.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP2-BCL",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-BCL:vsftpd-3.0.5-150200.12.9.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.s390x as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.s390x"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:vsftpd-3.0.5-150200.12.9.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:vsftpd-3.0.5-150200.12.9.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.x86_64 as component of SUSE Manager Proxy 4.1",
          "product_id": "SUSE Manager Proxy 4.1:vsftpd-3.0.5-150200.12.9.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Proxy 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.x86_64 as component of SUSE Manager Retail Branch Server 4.1",
          "product_id": "SUSE Manager Retail Branch Server 4.1:vsftpd-3.0.5-150200.12.9.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Retail Branch Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.ppc64le as component of SUSE Manager Server 4.1",
          "product_id": "SUSE Manager Server 4.1:vsftpd-3.0.5-150200.12.9.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Manager Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.s390x as component of SUSE Manager Server 4.1",
          "product_id": "SUSE Manager Server 4.1:vsftpd-3.0.5-150200.12.9.1.s390x"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.s390x",
        "relates_to_product_reference": "SUSE Manager Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.x86_64 as component of SUSE Manager Server 4.1",
          "product_id": "SUSE Manager Server 4.1:vsftpd-3.0.5-150200.12.9.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.aarch64 as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:vsftpd-3.0.5-150200.12.9.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.aarch64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.x86_64 as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:vsftpd-3.0.5-150200.12.9.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.x86_64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.aarch64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.ppc64le as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.s390x as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.s390x"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-150200.12.9.1.x86_64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-150200.12.9.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3618",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-3618"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 7:vsftpd-3.0.5-150200.12.9.1.aarch64",
          "SUSE Enterprise Storage 7:vsftpd-3.0.5-150200.12.9.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:vsftpd-3.0.5-150200.12.9.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:vsftpd-3.0.5-150200.12.9.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP2-BCL:vsftpd-3.0.5-150200.12.9.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.s390x",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:vsftpd-3.0.5-150200.12.9.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:vsftpd-3.0.5-150200.12.9.1.x86_64",
          "SUSE Manager Proxy 4.1:vsftpd-3.0.5-150200.12.9.1.x86_64",
          "SUSE Manager Retail Branch Server 4.1:vsftpd-3.0.5-150200.12.9.1.x86_64",
          "SUSE Manager Server 4.1:vsftpd-3.0.5-150200.12.9.1.ppc64le",
          "SUSE Manager Server 4.1:vsftpd-3.0.5-150200.12.9.1.s390x",
          "SUSE Manager Server 4.1:vsftpd-3.0.5-150200.12.9.1.x86_64",
          "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.aarch64",
          "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.ppc64le",
          "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.s390x",
          "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-3618",
          "url": "https://www.suse.com/security/cve/CVE-2021-3618"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187678 for CVE-2021-3618",
          "url": "https://bugzilla.suse.com/1187678"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 7:vsftpd-3.0.5-150200.12.9.1.aarch64",
            "SUSE Enterprise Storage 7:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:vsftpd-3.0.5-150200.12.9.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-BCL:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:vsftpd-3.0.5-150200.12.9.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Manager Proxy 4.1:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Manager Retail Branch Server 4.1:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Manager Server 4.1:vsftpd-3.0.5-150200.12.9.1.ppc64le",
            "SUSE Manager Server 4.1:vsftpd-3.0.5-150200.12.9.1.s390x",
            "SUSE Manager Server 4.1:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.aarch64",
            "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.ppc64le",
            "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.s390x",
            "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Enterprise Storage 7:vsftpd-3.0.5-150200.12.9.1.aarch64",
            "SUSE Enterprise Storage 7:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:vsftpd-3.0.5-150200.12.9.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-BCL:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:vsftpd-3.0.5-150200.12.9.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Manager Proxy 4.1:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Manager Retail Branch Server 4.1:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "SUSE Manager Server 4.1:vsftpd-3.0.5-150200.12.9.1.ppc64le",
            "SUSE Manager Server 4.1:vsftpd-3.0.5-150200.12.9.1.s390x",
            "SUSE Manager Server 4.1:vsftpd-3.0.5-150200.12.9.1.x86_64",
            "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.aarch64",
            "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.ppc64le",
            "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.s390x",
            "openSUSE Leap 15.3:vsftpd-3.0.5-150200.12.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-09-28T15:11:47Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-3618"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nginx",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nginx fixes the following issues:\n\n- CVE-2021-3618: Fixed the ALPACA attack limiting the number of errors after which the connection is closed (bsc#1187685).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2022-4265,SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-4265,SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-4265,SUSE-SLE-Product-SLES-15-SP2-BCL-2022-4265,SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-4265,SUSE-SLE-Product-SLES_SAP-15-SP2-2022-4265,SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-4265,SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-4265,SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-4265,SUSE-Storage-7-2022-4265",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_4265-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2022:4265-1",
        "url": "https://www.suse.com/support/update/announcement/2022/suse-su-20224265-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2022:4265-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013138.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187685",
        "url": "https://bugzilla.suse.com/1187685"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-3618 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-3618/"
      }
    ],
    "title": "Security update for nginx",
    "tracking": {
      "current_release_date": "2022-11-29T10:22:39Z",
      "generator": {
        "date": "2022-11-29T10:22:39Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2022:4265-1",
      "initial_release_date": "2022-11-29T10:22:39Z",
      "revision_history": [
        {
          "date": "2022-11-29T10:22:39Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.16.1-150200.3.9.1.aarch64",
                "product": {
                  "name": "nginx-1.16.1-150200.3.9.1.aarch64",
                  "product_id": "nginx-1.16.1-150200.3.9.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.16.1-150200.3.9.1.i586",
                "product": {
                  "name": "nginx-1.16.1-150200.3.9.1.i586",
                  "product_id": "nginx-1.16.1-150200.3.9.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-source-1.16.1-150200.3.9.1.noarch",
                "product": {
                  "name": "nginx-source-1.16.1-150200.3.9.1.noarch",
                  "product_id": "nginx-source-1.16.1-150200.3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "vim-plugin-nginx-1.16.1-150200.3.9.1.noarch",
                "product": {
                  "name": "vim-plugin-nginx-1.16.1-150200.3.9.1.noarch",
                  "product_id": "vim-plugin-nginx-1.16.1-150200.3.9.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.16.1-150200.3.9.1.ppc64le",
                "product": {
                  "name": "nginx-1.16.1-150200.3.9.1.ppc64le",
                  "product_id": "nginx-1.16.1-150200.3.9.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.16.1-150200.3.9.1.s390x",
                "product": {
                  "name": "nginx-1.16.1-150200.3.9.1.s390x",
                  "product_id": "nginx-1.16.1-150200.3.9.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.16.1-150200.3.9.1.x86_64",
                "product": {
                  "name": "nginx-1.16.1-150200.3.9.1.x86_64",
                  "product_id": "nginx-1.16.1-150200.3.9.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP2-BCL",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP2-BCL",
                  "product_id": "SUSE Linux Enterprise Server 15 SP2-BCL",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_bcl:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Manager Proxy 4.1",
                "product": {
                  "name": "SUSE Manager Proxy 4.1",
                  "product_id": "SUSE Manager Proxy 4.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-proxy:4.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Manager Retail Branch Server 4.1",
                "product": {
                  "name": "SUSE Manager Retail Branch Server 4.1",
                  "product_id": "SUSE Manager Retail Branch Server 4.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-retail-branch-server:4.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Manager Server 4.1",
                "product": {
                  "name": "SUSE Manager Server 4.1",
                  "product_id": "SUSE Manager Server 4.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-server:4.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Enterprise Storage 7",
                "product": {
                  "name": "SUSE Enterprise Storage 7",
                  "product_id": "SUSE Enterprise Storage 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:ses:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:nginx-1.16.1-150200.3.9.1.aarch64"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:nginx-1.16.1-150200.3.9.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.16.1-150200.3.9.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:nginx-source-1.16.1-150200.3.9.1.noarch"
        },
        "product_reference": "nginx-source-1.16.1-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.aarch64"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.16.1-150200.3.9.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nginx-source-1.16.1-150200.3.9.1.noarch"
        },
        "product_reference": "nginx-source-1.16.1-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP2-BCL",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-BCL:nginx-1.16.1-150200.3.9.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.16.1-150200.3.9.1.noarch as component of SUSE Linux Enterprise Server 15 SP2-BCL",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-BCL:nginx-source-1.16.1-150200.3.9.1.noarch"
        },
        "product_reference": "nginx-source-1.16.1-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.aarch64"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.ppc64le"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.s390x as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.s390x"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.16.1-150200.3.9.1.noarch as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-source-1.16.1-150200.3.9.1.noarch"
        },
        "product_reference": "nginx-source-1.16.1-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:nginx-1.16.1-150200.3.9.1.ppc64le"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:nginx-1.16.1-150200.3.9.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.16.1-150200.3.9.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:nginx-source-1.16.1-150200.3.9.1.noarch"
        },
        "product_reference": "nginx-source-1.16.1-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.x86_64 as component of SUSE Manager Proxy 4.1",
          "product_id": "SUSE Manager Proxy 4.1:nginx-1.16.1-150200.3.9.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Proxy 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.16.1-150200.3.9.1.noarch as component of SUSE Manager Proxy 4.1",
          "product_id": "SUSE Manager Proxy 4.1:nginx-source-1.16.1-150200.3.9.1.noarch"
        },
        "product_reference": "nginx-source-1.16.1-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.x86_64 as component of SUSE Manager Retail Branch Server 4.1",
          "product_id": "SUSE Manager Retail Branch Server 4.1:nginx-1.16.1-150200.3.9.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Retail Branch Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.16.1-150200.3.9.1.noarch as component of SUSE Manager Retail Branch Server 4.1",
          "product_id": "SUSE Manager Retail Branch Server 4.1:nginx-source-1.16.1-150200.3.9.1.noarch"
        },
        "product_reference": "nginx-source-1.16.1-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Manager Retail Branch Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.ppc64le as component of SUSE Manager Server 4.1",
          "product_id": "SUSE Manager Server 4.1:nginx-1.16.1-150200.3.9.1.ppc64le"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Manager Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.s390x as component of SUSE Manager Server 4.1",
          "product_id": "SUSE Manager Server 4.1:nginx-1.16.1-150200.3.9.1.s390x"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.s390x",
        "relates_to_product_reference": "SUSE Manager Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.x86_64 as component of SUSE Manager Server 4.1",
          "product_id": "SUSE Manager Server 4.1:nginx-1.16.1-150200.3.9.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.16.1-150200.3.9.1.noarch as component of SUSE Manager Server 4.1",
          "product_id": "SUSE Manager Server 4.1:nginx-source-1.16.1-150200.3.9.1.noarch"
        },
        "product_reference": "nginx-source-1.16.1-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Manager Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.aarch64 as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:nginx-1.16.1-150200.3.9.1.aarch64"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.aarch64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150200.3.9.1.x86_64 as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:nginx-1.16.1-150200.3.9.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150200.3.9.1.x86_64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.16.1-150200.3.9.1.noarch as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:nginx-source-1.16.1-150200.3.9.1.noarch"
        },
        "product_reference": "nginx-source-1.16.1-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3618",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-3618"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 7:nginx-1.16.1-150200.3.9.1.aarch64",
          "SUSE Enterprise Storage 7:nginx-1.16.1-150200.3.9.1.x86_64",
          "SUSE Enterprise Storage 7:nginx-source-1.16.1-150200.3.9.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:nginx-1.16.1-150200.3.9.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:nginx-1.16.1-150200.3.9.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:nginx-source-1.16.1-150200.3.9.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nginx-source-1.16.1-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-BCL:nginx-1.16.1-150200.3.9.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP2-BCL:nginx-source-1.16.1-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.s390x",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-source-1.16.1-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:nginx-1.16.1-150200.3.9.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:nginx-1.16.1-150200.3.9.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:nginx-source-1.16.1-150200.3.9.1.noarch",
          "SUSE Manager Proxy 4.1:nginx-1.16.1-150200.3.9.1.x86_64",
          "SUSE Manager Proxy 4.1:nginx-source-1.16.1-150200.3.9.1.noarch",
          "SUSE Manager Retail Branch Server 4.1:nginx-1.16.1-150200.3.9.1.x86_64",
          "SUSE Manager Retail Branch Server 4.1:nginx-source-1.16.1-150200.3.9.1.noarch",
          "SUSE Manager Server 4.1:nginx-1.16.1-150200.3.9.1.ppc64le",
          "SUSE Manager Server 4.1:nginx-1.16.1-150200.3.9.1.s390x",
          "SUSE Manager Server 4.1:nginx-1.16.1-150200.3.9.1.x86_64",
          "SUSE Manager Server 4.1:nginx-source-1.16.1-150200.3.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-3618",
          "url": "https://www.suse.com/security/cve/CVE-2021-3618"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187678 for CVE-2021-3618",
          "url": "https://bugzilla.suse.com/1187678"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 7:nginx-1.16.1-150200.3.9.1.aarch64",
            "SUSE Enterprise Storage 7:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Enterprise Storage 7:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:nginx-1.16.1-150200.3.9.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-BCL:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:nginx-1.16.1-150200.3.9.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Manager Proxy 4.1:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Manager Proxy 4.1:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Manager Retail Branch Server 4.1:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Manager Server 4.1:nginx-1.16.1-150200.3.9.1.ppc64le",
            "SUSE Manager Server 4.1:nginx-1.16.1-150200.3.9.1.s390x",
            "SUSE Manager Server 4.1:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Manager Server 4.1:nginx-source-1.16.1-150200.3.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Enterprise Storage 7:nginx-1.16.1-150200.3.9.1.aarch64",
            "SUSE Enterprise Storage 7:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Enterprise Storage 7:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:nginx-1.16.1-150200.3.9.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-BCL:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:nginx-1.16.1-150200.3.9.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Manager Proxy 4.1:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Manager Proxy 4.1:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Manager Retail Branch Server 4.1:nginx-source-1.16.1-150200.3.9.1.noarch",
            "SUSE Manager Server 4.1:nginx-1.16.1-150200.3.9.1.ppc64le",
            "SUSE Manager Server 4.1:nginx-1.16.1-150200.3.9.1.s390x",
            "SUSE Manager Server 4.1:nginx-1.16.1-150200.3.9.1.x86_64",
            "SUSE Manager Server 4.1:nginx-source-1.16.1-150200.3.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-29T10:22:39Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-3618"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nginx",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nginx fixes the following issues:\n\n- CVE-2021-3618: Fixed the ALPACA attack limiting the number of errors after which the connection is closed (bsc#1187685).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2022-4192,SUSE-SLE-Product-HPC-15-2022-4192,SUSE-SLE-Product-SLES-15-2022-4192,SUSE-SLE-Product-SLES_SAP-15-2022-4192",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_4192-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2022:4192-1",
        "url": "https://www.suse.com/support/update/announcement/2022/suse-su-20224192-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2022:4192-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013089.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187685",
        "url": "https://bugzilla.suse.com/1187685"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-3618 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-3618/"
      }
    ],
    "title": "Security update for nginx",
    "tracking": {
      "current_release_date": "2022-11-23T10:05:21Z",
      "generator": {
        "date": "2022-11-23T10:05:21Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2022:4192-1",
      "initial_release_date": "2022-11-23T10:05:21Z",
      "revision_history": [
        {
          "date": "2022-11-23T10:05:21Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.16.1-150000.3.18.1.aarch64",
                "product": {
                  "name": "nginx-1.16.1-150000.3.18.1.aarch64",
                  "product_id": "nginx-1.16.1-150000.3.18.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.16.1-150000.3.18.1.i586",
                "product": {
                  "name": "nginx-1.16.1-150000.3.18.1.i586",
                  "product_id": "nginx-1.16.1-150000.3.18.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-source-1.16.1-150000.3.18.1.noarch",
                "product": {
                  "name": "nginx-source-1.16.1-150000.3.18.1.noarch",
                  "product_id": "nginx-source-1.16.1-150000.3.18.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "vim-plugin-nginx-1.16.1-150000.3.18.1.noarch",
                "product": {
                  "name": "vim-plugin-nginx-1.16.1-150000.3.18.1.noarch",
                  "product_id": "vim-plugin-nginx-1.16.1-150000.3.18.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.16.1-150000.3.18.1.ppc64le",
                "product": {
                  "name": "nginx-1.16.1-150000.3.18.1.ppc64le",
                  "product_id": "nginx-1.16.1-150000.3.18.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.16.1-150000.3.18.1.s390x",
                "product": {
                  "name": "nginx-1.16.1-150000.3.18.1.s390x",
                  "product_id": "nginx-1.16.1-150000.3.18.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.16.1-150000.3.18.1.x86_64",
                "product": {
                  "name": "nginx-1.16.1-150000.3.18.1.x86_64",
                  "product_id": "nginx-1.16.1-150000.3.18.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150000.3.18.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15-ESPOS:nginx-1.16.1-150000.3.18.1.aarch64"
        },
        "product_reference": "nginx-1.16.1-150000.3.18.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150000.3.18.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15-ESPOS:nginx-1.16.1-150000.3.18.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150000.3.18.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150000.3.18.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15-LTSS:nginx-1.16.1-150000.3.18.1.aarch64"
        },
        "product_reference": "nginx-1.16.1-150000.3.18.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150000.3.18.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15-LTSS:nginx-1.16.1-150000.3.18.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150000.3.18.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150000.3.18.1.aarch64 as component of SUSE Linux Enterprise Server 15-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.aarch64"
        },
        "product_reference": "nginx-1.16.1-150000.3.18.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150000.3.18.1.ppc64le as component of SUSE Linux Enterprise Server 15-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.ppc64le"
        },
        "product_reference": "nginx-1.16.1-150000.3.18.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150000.3.18.1.s390x as component of SUSE Linux Enterprise Server 15-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.s390x"
        },
        "product_reference": "nginx-1.16.1-150000.3.18.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150000.3.18.1.x86_64 as component of SUSE Linux Enterprise Server 15-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150000.3.18.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150000.3.18.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15:nginx-1.16.1-150000.3.18.1.ppc64le"
        },
        "product_reference": "nginx-1.16.1-150000.3.18.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150000.3.18.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15:nginx-1.16.1-150000.3.18.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150000.3.18.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3618",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-3618"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15-ESPOS:nginx-1.16.1-150000.3.18.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15-ESPOS:nginx-1.16.1-150000.3.18.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15-LTSS:nginx-1.16.1-150000.3.18.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15-LTSS:nginx-1.16.1-150000.3.18.1.x86_64",
          "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.aarch64",
          "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.ppc64le",
          "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.s390x",
          "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15:nginx-1.16.1-150000.3.18.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15:nginx-1.16.1-150000.3.18.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-3618",
          "url": "https://www.suse.com/security/cve/CVE-2021-3618"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187678 for CVE-2021-3618",
          "url": "https://bugzilla.suse.com/1187678"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15-ESPOS:nginx-1.16.1-150000.3.18.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15-ESPOS:nginx-1.16.1-150000.3.18.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15-LTSS:nginx-1.16.1-150000.3.18.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15-LTSS:nginx-1.16.1-150000.3.18.1.x86_64",
            "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.aarch64",
            "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.ppc64le",
            "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.s390x",
            "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15:nginx-1.16.1-150000.3.18.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15:nginx-1.16.1-150000.3.18.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15-ESPOS:nginx-1.16.1-150000.3.18.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15-ESPOS:nginx-1.16.1-150000.3.18.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15-LTSS:nginx-1.16.1-150000.3.18.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15-LTSS:nginx-1.16.1-150000.3.18.1.x86_64",
            "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.aarch64",
            "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.ppc64le",
            "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.s390x",
            "SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-150000.3.18.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15:nginx-1.16.1-150000.3.18.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15:nginx-1.16.1-150000.3.18.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-23T10:05:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-3618"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for vsftpd",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for vsftpd fixes the following issues:\n\n- CVE-2021-3618: Enforced security checks against ALPACA attack (PM-3322, bsc#1187686, bsc#1187678).\n\nBugfixes:\n- Fixed a seccomp failure in FIPS mode when SSL was enabled (bsc#1052900).\n- Allowed wait4() to be called so that the broker can wait for its child processes (bsc#1021387).\n- Allowed sendto() syscall when /dev/log support is enabled (bsc#786024).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2022-3888,SUSE-SLE-SERVER-12-SP5-2022-3888",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_3888-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2022:3888-1",
        "url": "https://www.suse.com/support/update/announcement/2022/suse-su-20223888-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2022:3888-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012822.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1021387",
        "url": "https://bugzilla.suse.com/1021387"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1052900",
        "url": "https://bugzilla.suse.com/1052900"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187678",
        "url": "https://bugzilla.suse.com/1187678"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187686",
        "url": "https://bugzilla.suse.com/1187686"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 786024",
        "url": "https://bugzilla.suse.com/786024"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-3618 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-3618/"
      }
    ],
    "title": "Security update for vsftpd",
    "tracking": {
      "current_release_date": "2022-11-07T13:24:18Z",
      "generator": {
        "date": "2022-11-07T13:24:18Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2022:3888-1",
      "initial_release_date": "2022-11-07T13:24:18Z",
      "revision_history": [
        {
          "date": "2022-11-07T13:24:18Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-51.1.aarch64",
                "product": {
                  "name": "vsftpd-3.0.5-51.1.aarch64",
                  "product_id": "vsftpd-3.0.5-51.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-51.1.i586",
                "product": {
                  "name": "vsftpd-3.0.5-51.1.i586",
                  "product_id": "vsftpd-3.0.5-51.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-51.1.ppc64le",
                "product": {
                  "name": "vsftpd-3.0.5-51.1.ppc64le",
                  "product_id": "vsftpd-3.0.5-51.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-51.1.s390",
                "product": {
                  "name": "vsftpd-3.0.5-51.1.s390",
                  "product_id": "vsftpd-3.0.5-51.1.s390"
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-51.1.s390x",
                "product": {
                  "name": "vsftpd-3.0.5-51.1.s390x",
                  "product_id": "vsftpd-3.0.5-51.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-51.1.x86_64",
                "product": {
                  "name": "vsftpd-3.0.5-51.1.x86_64",
                  "product_id": "vsftpd-3.0.5-51.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-51.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-51.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-51.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-51.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-51.1.s390x as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.s390x"
        },
        "product_reference": "vsftpd-3.0.5-51.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-51.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-51.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-51.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-51.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-51.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-51.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-51.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.s390x"
        },
        "product_reference": "vsftpd-3.0.5-51.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-51.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-51.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3618",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-3618"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-3618",
          "url": "https://www.suse.com/security/cve/CVE-2021-3618"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187678 for CVE-2021-3618",
          "url": "https://bugzilla.suse.com/1187678"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-51.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-51.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-07T13:24:18Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-3618"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nginx",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nginx fixes the following issues:\n\n- CVE-2021-3618: Fixed the ALPACA attack limiting the number of errors after which the connection is closed (bsc#1187685).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2022-4266,SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-4266,SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-4266,SUSE-SLE-Product-SLES-15-SP1-BCL-2022-4266,SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-4266,SUSE-SLE-Product-SLES_SAP-15-SP1-2022-4266,SUSE-Storage-6-2022-4266",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_4266-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2022:4266-1",
        "url": "https://www.suse.com/support/update/announcement/2022/suse-su-20224266-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2022:4266-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013137.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187685",
        "url": "https://bugzilla.suse.com/1187685"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-3618 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-3618/"
      }
    ],
    "title": "Security update for nginx",
    "tracking": {
      "current_release_date": "2022-11-29T10:23:14Z",
      "generator": {
        "date": "2022-11-29T10:23:14Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2022:4266-1",
      "initial_release_date": "2022-11-29T10:23:14Z",
      "revision_history": [
        {
          "date": "2022-11-29T10:23:14Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.16.1-150100.6.16.1.aarch64",
                "product": {
                  "name": "nginx-1.16.1-150100.6.16.1.aarch64",
                  "product_id": "nginx-1.16.1-150100.6.16.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.16.1-150100.6.16.1.i586",
                "product": {
                  "name": "nginx-1.16.1-150100.6.16.1.i586",
                  "product_id": "nginx-1.16.1-150100.6.16.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-source-1.16.1-150100.6.16.1.noarch",
                "product": {
                  "name": "nginx-source-1.16.1-150100.6.16.1.noarch",
                  "product_id": "nginx-source-1.16.1-150100.6.16.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "vim-plugin-nginx-1.16.1-150100.6.16.1.noarch",
                "product": {
                  "name": "vim-plugin-nginx-1.16.1-150100.6.16.1.noarch",
                  "product_id": "vim-plugin-nginx-1.16.1-150100.6.16.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.16.1-150100.6.16.1.ppc64le",
                "product": {
                  "name": "nginx-1.16.1-150100.6.16.1.ppc64le",
                  "product_id": "nginx-1.16.1-150100.6.16.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.16.1-150100.6.16.1.s390x",
                "product": {
                  "name": "nginx-1.16.1-150100.6.16.1.s390x",
                  "product_id": "nginx-1.16.1-150100.6.16.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.16.1-150100.6.16.1.x86_64",
                "product": {
                  "name": "nginx-1.16.1-150100.6.16.1.x86_64",
                  "product_id": "nginx-1.16.1-150100.6.16.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP1-BCL",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP1-BCL",
                  "product_id": "SUSE Linux Enterprise Server 15 SP1-BCL",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_bcl:15:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP1-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP1-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP1",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP1",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Enterprise Storage 6",
                "product": {
                  "name": "SUSE Enterprise Storage 6",
                  "product_id": "SUSE Enterprise Storage 6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:ses:6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150100.6.16.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:nginx-1.16.1-150100.6.16.1.aarch64"
        },
        "product_reference": "nginx-1.16.1-150100.6.16.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150100.6.16.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:nginx-1.16.1-150100.6.16.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150100.6.16.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.16.1-150100.6.16.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:nginx-source-1.16.1-150100.6.16.1.noarch"
        },
        "product_reference": "nginx-source-1.16.1-150100.6.16.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150100.6.16.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.aarch64"
        },
        "product_reference": "nginx-1.16.1-150100.6.16.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150100.6.16.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150100.6.16.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.16.1-150100.6.16.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:nginx-source-1.16.1-150100.6.16.1.noarch"
        },
        "product_reference": "nginx-source-1.16.1-150100.6.16.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150100.6.16.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP1-BCL",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-BCL:nginx-1.16.1-150100.6.16.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150100.6.16.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.16.1-150100.6.16.1.noarch as component of SUSE Linux Enterprise Server 15 SP1-BCL",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-BCL:nginx-source-1.16.1-150100.6.16.1.noarch"
        },
        "product_reference": "nginx-source-1.16.1-150100.6.16.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150100.6.16.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.aarch64"
        },
        "product_reference": "nginx-1.16.1-150100.6.16.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150100.6.16.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.ppc64le"
        },
        "product_reference": "nginx-1.16.1-150100.6.16.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150100.6.16.1.s390x as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.s390x"
        },
        "product_reference": "nginx-1.16.1-150100.6.16.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150100.6.16.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150100.6.16.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.16.1-150100.6.16.1.noarch as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-source-1.16.1-150100.6.16.1.noarch"
        },
        "product_reference": "nginx-source-1.16.1-150100.6.16.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150100.6.16.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:nginx-1.16.1-150100.6.16.1.ppc64le"
        },
        "product_reference": "nginx-1.16.1-150100.6.16.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150100.6.16.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:nginx-1.16.1-150100.6.16.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150100.6.16.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.16.1-150100.6.16.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:nginx-source-1.16.1-150100.6.16.1.noarch"
        },
        "product_reference": "nginx-source-1.16.1-150100.6.16.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150100.6.16.1.aarch64 as component of SUSE Enterprise Storage 6",
          "product_id": "SUSE Enterprise Storage 6:nginx-1.16.1-150100.6.16.1.aarch64"
        },
        "product_reference": "nginx-1.16.1-150100.6.16.1.aarch64",
        "relates_to_product_reference": "SUSE Enterprise Storage 6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.16.1-150100.6.16.1.x86_64 as component of SUSE Enterprise Storage 6",
          "product_id": "SUSE Enterprise Storage 6:nginx-1.16.1-150100.6.16.1.x86_64"
        },
        "product_reference": "nginx-1.16.1-150100.6.16.1.x86_64",
        "relates_to_product_reference": "SUSE Enterprise Storage 6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.16.1-150100.6.16.1.noarch as component of SUSE Enterprise Storage 6",
          "product_id": "SUSE Enterprise Storage 6:nginx-source-1.16.1-150100.6.16.1.noarch"
        },
        "product_reference": "nginx-source-1.16.1-150100.6.16.1.noarch",
        "relates_to_product_reference": "SUSE Enterprise Storage 6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3618",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-3618"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 6:nginx-1.16.1-150100.6.16.1.aarch64",
          "SUSE Enterprise Storage 6:nginx-1.16.1-150100.6.16.1.x86_64",
          "SUSE Enterprise Storage 6:nginx-source-1.16.1-150100.6.16.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:nginx-1.16.1-150100.6.16.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:nginx-1.16.1-150100.6.16.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:nginx-source-1.16.1-150100.6.16.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:nginx-source-1.16.1-150100.6.16.1.noarch",
          "SUSE Linux Enterprise Server 15 SP1-BCL:nginx-1.16.1-150100.6.16.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP1-BCL:nginx-source-1.16.1-150100.6.16.1.noarch",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.s390x",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-source-1.16.1-150100.6.16.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:nginx-1.16.1-150100.6.16.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:nginx-1.16.1-150100.6.16.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:nginx-source-1.16.1-150100.6.16.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-3618",
          "url": "https://www.suse.com/security/cve/CVE-2021-3618"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187678 for CVE-2021-3618",
          "url": "https://bugzilla.suse.com/1187678"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 6:nginx-1.16.1-150100.6.16.1.aarch64",
            "SUSE Enterprise Storage 6:nginx-1.16.1-150100.6.16.1.x86_64",
            "SUSE Enterprise Storage 6:nginx-source-1.16.1-150100.6.16.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:nginx-1.16.1-150100.6.16.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:nginx-1.16.1-150100.6.16.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:nginx-source-1.16.1-150100.6.16.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:nginx-source-1.16.1-150100.6.16.1.noarch",
            "SUSE Linux Enterprise Server 15 SP1-BCL:nginx-1.16.1-150100.6.16.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-BCL:nginx-source-1.16.1-150100.6.16.1.noarch",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-source-1.16.1-150100.6.16.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:nginx-1.16.1-150100.6.16.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:nginx-1.16.1-150100.6.16.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:nginx-source-1.16.1-150100.6.16.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Enterprise Storage 6:nginx-1.16.1-150100.6.16.1.aarch64",
            "SUSE Enterprise Storage 6:nginx-1.16.1-150100.6.16.1.x86_64",
            "SUSE Enterprise Storage 6:nginx-source-1.16.1-150100.6.16.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:nginx-1.16.1-150100.6.16.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:nginx-1.16.1-150100.6.16.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:nginx-source-1.16.1-150100.6.16.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:nginx-source-1.16.1-150100.6.16.1.noarch",
            "SUSE Linux Enterprise Server 15 SP1-BCL:nginx-1.16.1-150100.6.16.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-BCL:nginx-source-1.16.1-150100.6.16.1.noarch",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-1.16.1-150100.6.16.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:nginx-source-1.16.1-150100.6.16.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:nginx-1.16.1-150100.6.16.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:nginx-1.16.1-150100.6.16.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:nginx-source-1.16.1-150100.6.16.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-29T10:23:14Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-3618"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nginx",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nginx fixes the following issues:\n\n- CVE-2021-3618: Fixed the ALPACA attack limiting the number of errors after which the connection is closed (bsc#1187685).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2022-4201,SUSE-SLE-Module-Server-Applications-15-SP3-2022-4201,openSUSE-SLE-15.3-2022-4201,openSUSE-SLE-15.4-2022-4201",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_4201-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2022:4201-1",
        "url": "https://www.suse.com/support/update/announcement/2022/suse-su-20224201-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2022:4201-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013099.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187685",
        "url": "https://bugzilla.suse.com/1187685"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-3618 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-3618/"
      }
    ],
    "title": "Security update for nginx",
    "tracking": {
      "current_release_date": "2022-11-23T14:34:36Z",
      "generator": {
        "date": "2022-11-23T14:34:36Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2022:4201-1",
      "initial_release_date": "2022-11-23T14:34:36Z",
      "revision_history": [
        {
          "date": "2022-11-23T14:34:36Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.19.8-150300.3.9.1.aarch64",
                "product": {
                  "name": "nginx-1.19.8-150300.3.9.1.aarch64",
                  "product_id": "nginx-1.19.8-150300.3.9.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.19.8-150300.3.9.1.i586",
                "product": {
                  "name": "nginx-1.19.8-150300.3.9.1.i586",
                  "product_id": "nginx-1.19.8-150300.3.9.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-source-1.19.8-150300.3.9.1.noarch",
                "product": {
                  "name": "nginx-source-1.19.8-150300.3.9.1.noarch",
                  "product_id": "nginx-source-1.19.8-150300.3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "vim-plugin-nginx-1.19.8-150300.3.9.1.noarch",
                "product": {
                  "name": "vim-plugin-nginx-1.19.8-150300.3.9.1.noarch",
                  "product_id": "vim-plugin-nginx-1.19.8-150300.3.9.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.19.8-150300.3.9.1.ppc64le",
                "product": {
                  "name": "nginx-1.19.8-150300.3.9.1.ppc64le",
                  "product_id": "nginx-1.19.8-150300.3.9.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.19.8-150300.3.9.1.s390x",
                "product": {
                  "name": "nginx-1.19.8-150300.3.9.1.s390x",
                  "product_id": "nginx-1.19.8-150300.3.9.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.19.8-150300.3.9.1.x86_64",
                "product": {
                  "name": "nginx-1.19.8-150300.3.9.1.x86_64",
                  "product_id": "nginx-1.19.8-150300.3.9.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Server Applications 15 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Server Applications 15 SP3",
                  "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-server-applications:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.3",
                "product": {
                  "name": "openSUSE Leap 15.3",
                  "product_id": "openSUSE Leap 15.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.4",
                "product": {
                  "name": "openSUSE Leap 15.4",
                  "product_id": "openSUSE Leap 15.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.19.8-150300.3.9.1.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.aarch64"
        },
        "product_reference": "nginx-1.19.8-150300.3.9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.19.8-150300.3.9.1.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.ppc64le"
        },
        "product_reference": "nginx-1.19.8-150300.3.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.19.8-150300.3.9.1.s390x as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.s390x"
        },
        "product_reference": "nginx-1.19.8-150300.3.9.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.19.8-150300.3.9.1.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.x86_64"
        },
        "product_reference": "nginx-1.19.8-150300.3.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.19.8-150300.3.9.1.noarch as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-source-1.19.8-150300.3.9.1.noarch"
        },
        "product_reference": "nginx-source-1.19.8-150300.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.19.8-150300.3.9.1.aarch64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.aarch64"
        },
        "product_reference": "nginx-1.19.8-150300.3.9.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.19.8-150300.3.9.1.ppc64le as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.ppc64le"
        },
        "product_reference": "nginx-1.19.8-150300.3.9.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.19.8-150300.3.9.1.s390x as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.s390x"
        },
        "product_reference": "nginx-1.19.8-150300.3.9.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.19.8-150300.3.9.1.x86_64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.x86_64"
        },
        "product_reference": "nginx-1.19.8-150300.3.9.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.19.8-150300.3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:nginx-source-1.19.8-150300.3.9.1.noarch"
        },
        "product_reference": "nginx-source-1.19.8-150300.3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-plugin-nginx-1.19.8-150300.3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:vim-plugin-nginx-1.19.8-150300.3.9.1.noarch"
        },
        "product_reference": "vim-plugin-nginx-1.19.8-150300.3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-plugin-nginx-1.19.8-150300.3.9.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:vim-plugin-nginx-1.19.8-150300.3.9.1.noarch"
        },
        "product_reference": "vim-plugin-nginx-1.19.8-150300.3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3618",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-3618"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-source-1.19.8-150300.3.9.1.noarch",
          "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.aarch64",
          "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.ppc64le",
          "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.s390x",
          "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.x86_64",
          "openSUSE Leap 15.3:nginx-source-1.19.8-150300.3.9.1.noarch",
          "openSUSE Leap 15.3:vim-plugin-nginx-1.19.8-150300.3.9.1.noarch",
          "openSUSE Leap 15.4:vim-plugin-nginx-1.19.8-150300.3.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-3618",
          "url": "https://www.suse.com/security/cve/CVE-2021-3618"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187678 for CVE-2021-3618",
          "url": "https://bugzilla.suse.com/1187678"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-source-1.19.8-150300.3.9.1.noarch",
            "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.aarch64",
            "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.ppc64le",
            "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.s390x",
            "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.x86_64",
            "openSUSE Leap 15.3:nginx-source-1.19.8-150300.3.9.1.noarch",
            "openSUSE Leap 15.3:vim-plugin-nginx-1.19.8-150300.3.9.1.noarch",
            "openSUSE Leap 15.4:vim-plugin-nginx-1.19.8-150300.3.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-1.19.8-150300.3.9.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:nginx-source-1.19.8-150300.3.9.1.noarch",
            "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.aarch64",
            "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.ppc64le",
            "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.s390x",
            "openSUSE Leap 15.3:nginx-1.19.8-150300.3.9.1.x86_64",
            "openSUSE Leap 15.3:nginx-source-1.19.8-150300.3.9.1.noarch",
            "openSUSE Leap 15.3:vim-plugin-nginx-1.19.8-150300.3.9.1.noarch",
            "openSUSE Leap 15.4:vim-plugin-nginx-1.19.8-150300.3.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-23T14:34:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-3618"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for vsftpd",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for vsftpd fixes the following issues:\n\n- CVE-2021-3618: Enforced security checks against ALPACA attack (PM-3322, bsc#1187686, bsc#1187678).\n\nBugfixes:\n- Fixed a seccomp failure in FIPS mode when SSL was enabled (bsc#1052900).\n- Allowed wait4() to be called so that the broker can wait for its child processes (bsc#1021387).\n- Allowed sendto() syscall when /dev/log support is enabled (bsc#786024).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2022-3383,SUSE-SLE-SERVER-12-SP5-2022-3383",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_3383-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2022:3383-1",
        "url": "https://www.suse.com/support/update/announcement/2022/suse-su-20223383-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2022:3383-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-September/012371.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1021387",
        "url": "https://bugzilla.suse.com/1021387"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1052900",
        "url": "https://bugzilla.suse.com/1052900"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187678",
        "url": "https://bugzilla.suse.com/1187678"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187686",
        "url": "https://bugzilla.suse.com/1187686"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 786024",
        "url": "https://bugzilla.suse.com/786024"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-3618 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-3618/"
      }
    ],
    "title": "Security update for vsftpd",
    "tracking": {
      "current_release_date": "2022-09-26T10:34:31Z",
      "generator": {
        "date": "2022-09-26T10:34:31Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2022:3383-1",
      "initial_release_date": "2022-09-26T10:34:31Z",
      "revision_history": [
        {
          "date": "2022-09-26T10:34:31Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-47.7.1.aarch64",
                "product": {
                  "name": "vsftpd-3.0.5-47.7.1.aarch64",
                  "product_id": "vsftpd-3.0.5-47.7.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-47.7.1.i586",
                "product": {
                  "name": "vsftpd-3.0.5-47.7.1.i586",
                  "product_id": "vsftpd-3.0.5-47.7.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-47.7.1.ppc64le",
                "product": {
                  "name": "vsftpd-3.0.5-47.7.1.ppc64le",
                  "product_id": "vsftpd-3.0.5-47.7.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-47.7.1.s390",
                "product": {
                  "name": "vsftpd-3.0.5-47.7.1.s390",
                  "product_id": "vsftpd-3.0.5-47.7.1.s390"
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-47.7.1.s390x",
                "product": {
                  "name": "vsftpd-3.0.5-47.7.1.s390x",
                  "product_id": "vsftpd-3.0.5-47.7.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-47.7.1.x86_64",
                "product": {
                  "name": "vsftpd-3.0.5-47.7.1.x86_64",
                  "product_id": "vsftpd-3.0.5-47.7.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-47.7.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-47.7.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-47.7.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-47.7.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-47.7.1.s390x as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.s390x"
        },
        "product_reference": "vsftpd-3.0.5-47.7.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-47.7.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-47.7.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-47.7.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-47.7.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-47.7.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-47.7.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-47.7.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.s390x"
        },
        "product_reference": "vsftpd-3.0.5-47.7.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-47.7.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-47.7.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3618",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-3618"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-3618",
          "url": "https://www.suse.com/security/cve/CVE-2021-3618"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187678 for CVE-2021-3618",
          "url": "https://bugzilla.suse.com/1187678"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-47.7.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-47.7.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-09-26T10:34:31Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-3618"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Recommended update for vsftpd",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for vsftpd fixes the following issues:\n\nThis update enables vsftpd to speak TLS 1.3 in ssl FTP mode by linking against openssl 1.1.1.\n\nBugfixes added:\n\n- Fixed a seccomp failure in FIPS mode when SSL was enabled. [bsc#1052900]\n- allow stat() to be called, which is required during SSL initialization by RAND_load_file().\n- allow wait4() to be called so that the broker can wait for its child processes. [bsc#1021387]\n- Revert the \u0027ssl_tlsv1_X\u0027-style config file options back to their\n  original spelling. The changes that dropped the underscore from\n  the version numbers in release 3.0.4 breaks existing\n  configurations and it was never documented anywhere -- not in the\n  package\u0027s changelog and not in the packages\u0027s own man page.\n- vsftpd follows the system-wide TLS cipher policy \u0027DEFAULT_SUSE\u0027 by\n  default. Run the command \u0027openssl ciphers -v DEFAULT_SUSE\u0027 to see\n  which ciphers this includes.\n- allow sendto() syscall when /dev/log support is enabled. [bsc#786024]\n- allow sendto() to be called from check_limits(), which is necessary for\n  vsftpd to write to the system log.\n- Added hardening to systemd service(s) (bsc#1181400).\n\nUpdate to version 3.0.5:\n\n* Fix ALPN callback to correctly select the \u0027ftp\u0027 string if present.\n  Works with FileZilla-3.55.0.\n* Fix a couple of seccomp policy issues with Fedora 34.\n\nUpdate to version 3.0.4.\n\n* Fix runtime SIGSYS crashes (seccomp sandbox policy tweaks).\n* Reject HTTP verbs pre-login.\n* Disable TLS prior to v1.2 by default.\n* Close the control connection after 10 unknown commands pre-login.\n* Reject any TLS ALPN advertisement that\u0027s not \u0027ftp\u0027.\n* Add ssl_sni_hostname option to require a match on incoming SNI hostname.\n* The options \u0027ssl_tlsv1_1\u0027, \u0027ssl_tlsv1_2\u0027, and \u0027ssl_tlsv1_3\u0027\n  have been renamed to \u0027ssl_tlsv11\u0027, \u0027ssl_tlsv12\u0027, and\n  \u0027ssl_tlsv13\u0027 respectively. Note that the man page has not been\n  updated accordingly.\n\n- OpenSSL was updated to version 1.1.1 in SLE-15-SP2, adding\n  support for the TLSv1.3 protocol. As a consequence, some SLE-15\n  applications that link OpenSSL for TLS support -- like vsftpd --,\n  gained the ability to use the newer TLS protocol, which created\n  interoperability problems with FTP clients in some cases. To\n  remedy the situation, \u00270001-Introduce-TLSv1.3-option.patch\u0027 was\n  applied in a forked SLE-15-SP2 version of vsftpd. The patch adds\n  the configuration option \u0027ssl_tlsv1_3\u0027 that system administrators\n  can use to disable TLSv1.3 support on their servers.\n  [bsc#1187188]\n\n- allow getdents64 syscall in seccomp sandbox, fixes bsc#1179553\n- Add pam_keyinit.so to PAM config file.  [bsc#1144062]\n- Fixed a segmentation fault that occurred while trying to write to an\n  invalid TLS context. [bsc#1125951]\n- Enable wait4(), sysinfo(), and shutdown() syscalls in seccomp sandbox.\n  These are required for the daemon to work properly on SLE-15. [bsc#1089088,\n  bsc#1180314]\n- Add firewalld service file (bsc#1083705)\n- Make sure to also require group nobody and user ftp bsc#1070653\n- Fixed interoperability issue with various ftp clients that arose when\n  vsftpd is configured with option \u0027use_localtime=YES\u0027. Basically, it\u0027s\n  fine to use local time stamps in directory listings, but responding\n  to MDTM commands with any time zone other than UTC directly violates\n  RFC3659 and leads FTP clients to misinterpret the file\u0027s time\n  stamp. [bsc#1024961]\n\n- Conditionally install xinetd service only on older releases\n  * On current distributions we support the same functionality\n    via systemd socket activation\n- Fix build against OpenSSL 1.1.  (bsc#1042673)\n\n- Version bump to 3.0.3:\n\n* Increase VSFTP_AS_LIMIT to 200MB; various reports.\n* Make the PWD response more RFC compliant; report from Barry Kelly\n  \u003cbarry@modeltwozero.com\u003e.\n* Remove the trailing period from EPSV response to work around BT Internet\n  issues; report from Tim Bishop \u003ctdb@mirrorservice.org\u003e.\n* Fix syslog_enable issues vs. seccomp filtering. Report from Michal Vyskocil\n  \u003cmvyskocil@suse.cz\u003e. At least, syslogging seems to work on my Fedora now.\n* Allow gettimeofday() in the seccomp sandbox. I can\u0027t repro failures, but I\n  probably have a different distro / libc / etc. and there are multiple reports.\n* Some kernels support PR_SET_NO_NEW_PRIVS but not PR_SET_SECCOMP, so handle\n  this case gracefully. Report from Vasily Averin \u003cvvs@odin.com\u003e.\n* List the TLS1.2 cipher AES128-GCM-SHA256 as first preference by default.\n* Make some compile-time SSL defaults (such as correct client shutdown\n  handling) stricter.\n* Disable Nagle algorithm during SSL data connection shutdown, to avoid 200ms\n  delays. From Tim Kosse \u003ctim.kosse@filezilla-project.org\u003e.\n* Kill the FTP session if we see HTTP protocol commands, to avoid\n  cross-protocol attacks. A report from Jann Horn \u003cjann@thejh.net\u003e.\n* Kill the FTP session if we see session re-use failure. A report from\n  Tim Kosse \u003ctim.kosse@filezilla-project.org\u003e.\n* Enable ECDHE, Tim Kosse \u003ctim.kosse@filezilla-project.org\u003e.\n* Default cipher list is now just ECDHE-RSA-AES256-GCM-SHA384.\n* Minor SSL logging improvements.\n* Un-default tunable_strict_ssl_write_shutdown again. We still have\n  tunable_strict_ssl_read_eof defaulted now, which is the important one to prove\n  upload integrity.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2022-655,SUSE-SLE-SERVER-12-SP5-2022-655",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-ru-2022_0655-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-RU-2022:0655-1",
        "url": "https://www.suse.com/support/update/announcement//suse-ru-20220655-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-RU-2022:0655-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2022-March/021907.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1042673",
        "url": "https://bugzilla.suse.com/1042673"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1070653",
        "url": "https://bugzilla.suse.com/1070653"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1083705",
        "url": "https://bugzilla.suse.com/1083705"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1089088",
        "url": "https://bugzilla.suse.com/1089088"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1125951",
        "url": "https://bugzilla.suse.com/1125951"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1144062",
        "url": "https://bugzilla.suse.com/1144062"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179553",
        "url": "https://bugzilla.suse.com/1179553"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1180314",
        "url": "https://bugzilla.suse.com/1180314"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1181400",
        "url": "https://bugzilla.suse.com/1181400"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187188",
        "url": "https://bugzilla.suse.com/1187188"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187686",
        "url": "https://bugzilla.suse.com/1187686"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 786024",
        "url": "https://bugzilla.suse.com/786024"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-3618 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-3618/"
      }
    ],
    "title": "Recommended update for vsftpd",
    "tracking": {
      "current_release_date": "2022-03-24T11:04:18Z",
      "generator": {
        "date": "2022-03-24T11:04:18Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-RU-2022:0655-1",
      "initial_release_date": "2022-03-24T11:04:18Z",
      "revision_history": [
        {
          "date": "2022-03-24T11:04:18Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-48.3.1.aarch64",
                "product": {
                  "name": "vsftpd-3.0.5-48.3.1.aarch64",
                  "product_id": "vsftpd-3.0.5-48.3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-48.3.1.i586",
                "product": {
                  "name": "vsftpd-3.0.5-48.3.1.i586",
                  "product_id": "vsftpd-3.0.5-48.3.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-48.3.1.ppc64le",
                "product": {
                  "name": "vsftpd-3.0.5-48.3.1.ppc64le",
                  "product_id": "vsftpd-3.0.5-48.3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-48.3.1.s390",
                "product": {
                  "name": "vsftpd-3.0.5-48.3.1.s390",
                  "product_id": "vsftpd-3.0.5-48.3.1.s390"
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-48.3.1.s390x",
                "product": {
                  "name": "vsftpd-3.0.5-48.3.1.s390x",
                  "product_id": "vsftpd-3.0.5-48.3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vsftpd-3.0.5-48.3.1.x86_64",
                "product": {
                  "name": "vsftpd-3.0.5-48.3.1.x86_64",
                  "product_id": "vsftpd-3.0.5-48.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-48.3.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-48.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-48.3.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-48.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-48.3.1.s390x as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.s390x"
        },
        "product_reference": "vsftpd-3.0.5-48.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-48.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-48.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-48.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.aarch64"
        },
        "product_reference": "vsftpd-3.0.5-48.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-48.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.ppc64le"
        },
        "product_reference": "vsftpd-3.0.5-48.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-48.3.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.s390x"
        },
        "product_reference": "vsftpd-3.0.5-48.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vsftpd-3.0.5-48.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.x86_64"
        },
        "product_reference": "vsftpd-3.0.5-48.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3618",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-3618"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-3618",
          "url": "https://www.suse.com/security/cve/CVE-2021-3618"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187678 for CVE-2021-3618",
          "url": "https://bugzilla.suse.com/1187678"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:vsftpd-3.0.5-48.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:vsftpd-3.0.5-48.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-03-24T11:04:18Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-3618"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Transport Layer Security (TLS) ist ein hybrides Verschl\u00fcsselungsprotokoll zur Daten\u00fcbertragung im Internet.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiedenen TLS Implementierungen ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-1482 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1482.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-1482 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1482"
      },
      {
        "category": "external",
        "summary": "Alpaca Attack vom 2022-01-09",
        "url": "https://alpaca-attack.com/"
      },
      {
        "category": "external",
        "summary": "Bugzilla vom 2022-01-09",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975623"
      },
      {
        "category": "external",
        "summary": "Archlinux vom 2022-01-09",
        "url": "https://security.archlinux.org/CVE-2021-3618"
      },
      {
        "category": "external",
        "summary": "Debian vom 2022-01-09",
        "url": "https://security-tracker.debian.org/tracker/CVE-2021-3618"
      },
      {
        "category": "external",
        "summary": "Exim vom 2022-01-09",
        "url": "https://lists.exim.org/lurker/message/20210609.200324.f0e073ed.el.html"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5371-1 vom 2022-04-13",
        "url": "https://ubuntu.com/security/notices/USN-5371-1"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5371-2 vom 2022-04-28",
        "url": "https://ubuntu.com/security/notices/USN-5371-2"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:3320-1 vom 2022-09-20",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-September/012296.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:3383-1 vom 2022-09-26",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-September/012371.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:3457-1 vom 2022-09-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-September/012443.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:3458-1 vom 2022-09-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-September/012444.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2022-132 vom 2022-09-29",
        "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-132.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2022-136 vom 2022-09-29",
        "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-136.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2022-171 vom 2022-11-04",
        "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-171.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2022-172 vom 2022-11-04",
        "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-172.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:3888-1 vom 2022-11-07",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012822.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-3203 vom 2022-11-23",
        "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:4201-1 vom 2022-11-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013099.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:4192-1 vom 2022-11-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013089.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:4265-1 vom 2022-11-29",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013138.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:4266-1 vom 2022-11-29",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013137.html"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-6379-1 vom 2023-09-18",
        "url": "https://ubuntu.com/security/notices/USN-6379-1"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALASNGINX1-2023-002 vom 2023-09-28",
        "url": "https://alas.aws.amazon.com/AL2/ALASNGINX1-2023-002.html"
      },
      {
        "category": "external",
        "summary": "Moxa Security Advisory MPSA-241044 vom 2024-11-04",
        "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241044-vulnerabilities-identified-in-mds-g4028-l3-series-and-eds-g512e"
      }
    ],
    "source_lang": "en-US",
    "title": "TLS Implementierungen: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
    "tracking": {
      "current_release_date": "2024-11-03T23:00:00.000+00:00",
      "generator": {
        "date": "2024-11-04T09:10:09.932+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.8"
        }
      },
      "id": "WID-SEC-W-2022-1482",
      "initial_release_date": "2022-01-09T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-01-09T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2022-04-12T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2022-04-27T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2022-09-20T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-09-26T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-09-28T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-09-29T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2022-11-06T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2022-11-07T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-11-22T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2022-11-23T23:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-11-29T23:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-09-18T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2023-09-27T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2024-11-03T23:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von moxa aufgenommen"
        }
      ],
      "status": "final",
      "version": "15"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MDS-G4028-L3 Series",
                "product": {
                  "name": "Moxa Switch MDS-G4028-L3 Series",
                  "product_id": "T038734",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:moxa:switch:mds-g4028-l3_series"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "EDS-G512E",
                "product": {
                  "name": "Moxa Switch EDS-G512E",
                  "product_id": "T038749",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:moxa:switch:eds-g512e"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Switch"
          }
        ],
        "category": "vendor",
        "name": "Moxa"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.21.0",
                "product": {
                  "name": "NGINX NGINX \u003c1.21.0",
                  "product_id": "987482"
                }
              },
              {
                "category": "product_version",
                "name": "1.21.0",
                "product": {
                  "name": "NGINX NGINX 1.21.0",
                  "product_id": "987482-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:nginx:nginx:1.21.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "NGINX"
          }
        ],
        "category": "vendor",
        "name": "NGINX"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.16.1",
                "product": {
                  "name": "Open Source sendmail \u003c3.16.1",
                  "product_id": "T021499"
                }
              },
              {
                "category": "product_version",
                "name": "3.16.1",
                "product": {
                  "name": "Open Source sendmail 3.16.1",
                  "product_id": "T021499-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:sendmail:sendmail:3.16.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "sendmail"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3618",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in verschiedenen TLS Implementierungen. Der Fehler besteht aufgrund eines Logikfehlers, wenn verschiedene Protokolle behandelt werden, aber kompatible Zertifikate verwendet werden, wie z. B. Multi-Domain- oder Wildcard-Zertifikate. Ein entfernter anonymer Angreifer, der in der Lage ist, einen MitM-Angriff auf der TCP/IP-Schicht durchzuf\u00fchren, kann den Datenverkehr von einer Subdomain auf eine andere bzw. von einem Dienst auf einen anderen umleiten, was zu einer g\u00fcltigen TLS-Sitzung f\u00fchrt. Der Angreifer kann dies ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen und um andere unbekannte Auswirkungen hervorzurufen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T021499",
          "2951",
          "T002207",
          "987482",
          "T000126",
          "T038749",
          "398363",
          "T038734"
        ]
      },
      "release_date": "2022-01-09T23:00:00.000+00:00",
      "title": "CVE-2021-3618"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "FreeFlow-Druckserver ist eine Druckserveranwendung f\u00fcr Xerox-Produktionsdrucker, die Flexibilit\u00e4t, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-2031 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2031.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-2031 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2031"
      },
      {
        "category": "external",
        "summary": "Xerox Security Bulletin vom 2023-08-09",
        "url": "https://security.business.xerox.com/wp-content/uploads/2023/08/cert_XRX23-011_FFPSv7-S11_MediaInstall_Aug2023.pdf"
      },
      {
        "category": "external",
        "summary": "Xerox Security Bulletin vom 2023-08-09",
        "url": "https://security.business.xerox.com/wp-content/uploads/2023/08/cert_XRX23-012_FFPSv2_Win10_SecurityBulletin_Aug2023.pdf"
      },
      {
        "category": "external",
        "summary": "XEROX Security Advisory XRX23-013 vom 2023-08-24",
        "url": "https://securitydocs.business.xerox.com/wp-content/uploads/2023/08/Xerox-Security-Bulletin-XRX23-013-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v9.pdf"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2023-2331 vom 2023-11-02",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-2331.html"
      },
      {
        "category": "external",
        "summary": "Gentoo Linux Security Advisory GLSA-202408-17 vom 2024-08-09",
        "url": "https://security.gentoo.org/glsa/202408-17"
      }
    ],
    "source_lang": "en-US",
    "title": "Xerox FreeFlow Print Server: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-08-08T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:56:55.155+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-2031",
      "initial_release_date": "2023-08-09T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-08-09T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-08-24T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von XEROX aufgenommen"
        },
        {
          "date": "2023-11-02T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2024-08-08T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Gentoo aufgenommen"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Gentoo Linux",
            "product": {
              "name": "Gentoo Linux",
              "product_id": "T012167",
              "product_identification_helper": {
                "cpe": "cpe:/o:gentoo:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Gentoo"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "v2",
                "product": {
                  "name": "Xerox FreeFlow Print Server v2",
                  "product_id": "T014888",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:xerox:freeflow_print_server:v2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v9",
                "product": {
                  "name": "Xerox FreeFlow Print Server v9",
                  "product_id": "T015632",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:xerox:freeflow_print_server:v9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v7 for Solaris",
                "product": {
                  "name": "Xerox FreeFlow Print Server v7 for Solaris",
                  "product_id": "T029230",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:xerox:freeflow_print_server:v7_for_solaris"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FreeFlow Print Server"
          }
        ],
        "category": "vendor",
        "name": "Xerox"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2004-0687",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2004-0687"
    },
    {
      "cve": "CVE-2020-23903",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2020-23903"
    },
    {
      "cve": "CVE-2020-23904",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2020-23904"
    },
    {
      "cve": "CVE-2021-33621",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2021-33621"
    },
    {
      "cve": "CVE-2021-33657",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2021-33657"
    },
    {
      "cve": "CVE-2021-3575",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2021-3575"
    },
    {
      "cve": "CVE-2021-3618",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2021-3618"
    },
    {
      "cve": "CVE-2021-43618",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2021-43618"
    },
    {
      "cve": "CVE-2022-2097",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-2097"
    },
    {
      "cve": "CVE-2022-21123",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-21123"
    },
    {
      "cve": "CVE-2022-21125",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-21125"
    },
    {
      "cve": "CVE-2022-21127",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-21127"
    },
    {
      "cve": "CVE-2022-21166",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-21166"
    },
    {
      "cve": "CVE-2022-21589",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-21589"
    },
    {
      "cve": "CVE-2022-21592",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-21592"
    },
    {
      "cve": "CVE-2022-21608",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-21608"
    },
    {
      "cve": "CVE-2022-21617",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-21617"
    },
    {
      "cve": "CVE-2022-28805",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-28805"
    },
    {
      "cve": "CVE-2022-30115",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-30115"
    },
    {
      "cve": "CVE-2022-31783",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-31783"
    },
    {
      "cve": "CVE-2022-33099",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-33099"
    },
    {
      "cve": "CVE-2022-3729",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-3729"
    },
    {
      "cve": "CVE-2022-37290",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-37290"
    },
    {
      "cve": "CVE-2022-37434",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-37434"
    },
    {
      "cve": "CVE-2022-39348",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-39348"
    },
    {
      "cve": "CVE-2022-40897",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-40897"
    },
    {
      "cve": "CVE-2022-41716",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-41716"
    },
    {
      "cve": "CVE-2022-41717",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-41717"
    },
    {
      "cve": "CVE-2022-41720",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-41720"
    },
    {
      "cve": "CVE-2022-41722",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-41722"
    },
    {
      "cve": "CVE-2022-41723",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-41723"
    },
    {
      "cve": "CVE-2022-41724",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-41724"
    },
    {
      "cve": "CVE-2022-41725",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-41725"
    },
    {
      "cve": "CVE-2022-42898",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-42898"
    },
    {
      "cve": "CVE-2022-42916",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-42916"
    },
    {
      "cve": "CVE-2022-43551",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-43551"
    },
    {
      "cve": "CVE-2022-43552",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-43552"
    },
    {
      "cve": "CVE-2022-44617",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-44617"
    },
    {
      "cve": "CVE-2022-44792",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-44792"
    },
    {
      "cve": "CVE-2022-44793",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-44793"
    },
    {
      "cve": "CVE-2022-46285",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-46285"
    },
    {
      "cve": "CVE-2022-46663",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-46663"
    },
    {
      "cve": "CVE-2022-46908",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-46908"
    },
    {
      "cve": "CVE-2022-4743",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-4743"
    },
    {
      "cve": "CVE-2022-48303",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-48303"
    },
    {
      "cve": "CVE-2022-4883",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-4883"
    },
    {
      "cve": "CVE-2022-4904",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2022-4904"
    },
    {
      "cve": "CVE-2023-0002",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-0002"
    },
    {
      "cve": "CVE-2023-0215",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-0215"
    },
    {
      "cve": "CVE-2023-0494",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-0494"
    },
    {
      "cve": "CVE-2023-0547",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-0547"
    },
    {
      "cve": "CVE-2023-1161",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-1161"
    },
    {
      "cve": "CVE-2023-1945",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-1945"
    },
    {
      "cve": "CVE-2023-1992",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-1992"
    },
    {
      "cve": "CVE-2023-1993",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-1993"
    },
    {
      "cve": "CVE-2023-1994",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-1994"
    },
    {
      "cve": "CVE-2023-1999",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-1999"
    },
    {
      "cve": "CVE-2023-21526",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21526"
    },
    {
      "cve": "CVE-2023-21756",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21756"
    },
    {
      "cve": "CVE-2023-21911",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21911"
    },
    {
      "cve": "CVE-2023-21912",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21912"
    },
    {
      "cve": "CVE-2023-21919",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21919"
    },
    {
      "cve": "CVE-2023-21920",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21920"
    },
    {
      "cve": "CVE-2023-21929",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21929"
    },
    {
      "cve": "CVE-2023-21933",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21933"
    },
    {
      "cve": "CVE-2023-21935",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21935"
    },
    {
      "cve": "CVE-2023-21940",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21940"
    },
    {
      "cve": "CVE-2023-21945",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21945"
    },
    {
      "cve": "CVE-2023-21946",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21946"
    },
    {
      "cve": "CVE-2023-21947",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21947"
    },
    {
      "cve": "CVE-2023-21953",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21953"
    },
    {
      "cve": "CVE-2023-21955",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21955"
    },
    {
      "cve": "CVE-2023-21962",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21962"
    },
    {
      "cve": "CVE-2023-21966",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21966"
    },
    {
      "cve": "CVE-2023-21972",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21972"
    },
    {
      "cve": "CVE-2023-21976",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21976"
    },
    {
      "cve": "CVE-2023-21977",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21977"
    },
    {
      "cve": "CVE-2023-21980",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21980"
    },
    {
      "cve": "CVE-2023-21982",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21982"
    },
    {
      "cve": "CVE-2023-21995",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-21995"
    },
    {
      "cve": "CVE-2023-22006",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-22006"
    },
    {
      "cve": "CVE-2023-22023",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-22023"
    },
    {
      "cve": "CVE-2023-22036",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-22036"
    },
    {
      "cve": "CVE-2023-22041",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-22041"
    },
    {
      "cve": "CVE-2023-22044",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-22044"
    },
    {
      "cve": "CVE-2023-22045",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-22045"
    },
    {
      "cve": "CVE-2023-22049",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-22049"
    },
    {
      "cve": "CVE-2023-23931",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-23931"
    },
    {
      "cve": "CVE-2023-24021",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-24021"
    },
    {
      "cve": "CVE-2023-24532",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-24532"
    },
    {
      "cve": "CVE-2023-24534",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-24534"
    },
    {
      "cve": "CVE-2023-24536",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-24536"
    },
    {
      "cve": "CVE-2023-24537",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-24537"
    },
    {
      "cve": "CVE-2023-24538",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-24538"
    },
    {
      "cve": "CVE-2023-24539",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-24539"
    },
    {
      "cve": "CVE-2023-24540",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-24540"
    },
    {
      "cve": "CVE-2023-24932",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-24932"
    },
    {
      "cve": "CVE-2023-24998",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-24998"
    },
    {
      "cve": "CVE-2023-25193",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-25193"
    },
    {
      "cve": "CVE-2023-25652",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-25652"
    },
    {
      "cve": "CVE-2023-25690",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-25690"
    },
    {
      "cve": "CVE-2023-25815",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-25815"
    },
    {
      "cve": "CVE-2023-26767",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-26767"
    },
    {
      "cve": "CVE-2023-26768",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-26768"
    },
    {
      "cve": "CVE-2023-26769",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-26769"
    },
    {
      "cve": "CVE-2023-2731",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-2731"
    },
    {
      "cve": "CVE-2023-27320",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-27320"
    },
    {
      "cve": "CVE-2023-27522",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-27522"
    },
    {
      "cve": "CVE-2023-28005",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-28005"
    },
    {
      "cve": "CVE-2023-28484",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-28484"
    },
    {
      "cve": "CVE-2023-28486",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-28486"
    },
    {
      "cve": "CVE-2023-28487",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-28487"
    },
    {
      "cve": "CVE-2023-28709",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-28709"
    },
    {
      "cve": "CVE-2023-28755",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-28755"
    },
    {
      "cve": "CVE-2023-28756",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-28756"
    },
    {
      "cve": "CVE-2023-29007",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-29007"
    },
    {
      "cve": "CVE-2023-29400",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-29400"
    },
    {
      "cve": "CVE-2023-29469",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-29469"
    },
    {
      "cve": "CVE-2023-29479",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-29479"
    },
    {
      "cve": "CVE-2023-29531",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-29531"
    },
    {
      "cve": "CVE-2023-29532",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-29532"
    },
    {
      "cve": "CVE-2023-29533",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-29533"
    },
    {
      "cve": "CVE-2023-29535",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-29535"
    },
    {
      "cve": "CVE-2023-29536",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-29536"
    },
    {
      "cve": "CVE-2023-29539",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-29539"
    },
    {
      "cve": "CVE-2023-29541",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-29541"
    },
    {
      "cve": "CVE-2023-29542",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-29542"
    },
    {
      "cve": "CVE-2023-29545",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-29545"
    },
    {
      "cve": "CVE-2023-29548",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-29548"
    },
    {
      "cve": "CVE-2023-29550",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-29550"
    },
    {
      "cve": "CVE-2023-30086",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-30086"
    },
    {
      "cve": "CVE-2023-30608",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-30608"
    },
    {
      "cve": "CVE-2023-30774",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-30774"
    },
    {
      "cve": "CVE-2023-30775",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-30775"
    },
    {
      "cve": "CVE-2023-31047",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-31047"
    },
    {
      "cve": "CVE-2023-31284",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-31284"
    },
    {
      "cve": "CVE-2023-32034",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32034"
    },
    {
      "cve": "CVE-2023-32035",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32035"
    },
    {
      "cve": "CVE-2023-32038",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32038"
    },
    {
      "cve": "CVE-2023-32039",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32039"
    },
    {
      "cve": "CVE-2023-32040",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32040"
    },
    {
      "cve": "CVE-2023-32041",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32041"
    },
    {
      "cve": "CVE-2023-32042",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32042"
    },
    {
      "cve": "CVE-2023-32043",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32043"
    },
    {
      "cve": "CVE-2023-32044",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32044"
    },
    {
      "cve": "CVE-2023-32045",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32045"
    },
    {
      "cve": "CVE-2023-32046",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32046"
    },
    {
      "cve": "CVE-2023-32049",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32049"
    },
    {
      "cve": "CVE-2023-32053",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32053"
    },
    {
      "cve": "CVE-2023-32054",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32054"
    },
    {
      "cve": "CVE-2023-32055",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32055"
    },
    {
      "cve": "CVE-2023-32057",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32057"
    },
    {
      "cve": "CVE-2023-32085",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32085"
    },
    {
      "cve": "CVE-2023-32205",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32205"
    },
    {
      "cve": "CVE-2023-32206",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32206"
    },
    {
      "cve": "CVE-2023-32207",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32207"
    },
    {
      "cve": "CVE-2023-32208",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32208"
    },
    {
      "cve": "CVE-2023-32209",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32209"
    },
    {
      "cve": "CVE-2023-32210",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32210"
    },
    {
      "cve": "CVE-2023-32211",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32211"
    },
    {
      "cve": "CVE-2023-32212",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32212"
    },
    {
      "cve": "CVE-2023-32213",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32213"
    },
    {
      "cve": "CVE-2023-32214",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32214"
    },
    {
      "cve": "CVE-2023-32215",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32215"
    },
    {
      "cve": "CVE-2023-32216",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32216"
    },
    {
      "cve": "CVE-2023-32324",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-32324"
    },
    {
      "cve": "CVE-2023-33134",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-33134"
    },
    {
      "cve": "CVE-2023-33154",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-33154"
    },
    {
      "cve": "CVE-2023-33157",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-33157"
    },
    {
      "cve": "CVE-2023-33160",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-33160"
    },
    {
      "cve": "CVE-2023-33164",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-33164"
    },
    {
      "cve": "CVE-2023-33166",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-33166"
    },
    {
      "cve": "CVE-2023-33167",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-33167"
    },
    {
      "cve": "CVE-2023-33168",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-33168"
    },
    {
      "cve": "CVE-2023-33169",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-33169"
    },
    {
      "cve": "CVE-2023-33172",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-33172"
    },
    {
      "cve": "CVE-2023-33173",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-33173"
    },
    {
      "cve": "CVE-2023-33174",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-33174"
    },
    {
      "cve": "CVE-2023-34414",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-34414"
    },
    {
      "cve": "CVE-2023-34415",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-34415"
    },
    {
      "cve": "CVE-2023-34416",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-34416"
    },
    {
      "cve": "CVE-2023-34417",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-34417"
    },
    {
      "cve": "CVE-2023-3482",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-3482"
    },
    {
      "cve": "CVE-2023-34981",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-34981"
    },
    {
      "cve": "CVE-2023-35296",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35296"
    },
    {
      "cve": "CVE-2023-35297",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35297"
    },
    {
      "cve": "CVE-2023-35299",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35299"
    },
    {
      "cve": "CVE-2023-35300",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35300"
    },
    {
      "cve": "CVE-2023-35302",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35302"
    },
    {
      "cve": "CVE-2023-35303",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35303"
    },
    {
      "cve": "CVE-2023-35304",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35304"
    },
    {
      "cve": "CVE-2023-35305",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35305"
    },
    {
      "cve": "CVE-2023-35306",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35306"
    },
    {
      "cve": "CVE-2023-35308",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35308"
    },
    {
      "cve": "CVE-2023-35309",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35309"
    },
    {
      "cve": "CVE-2023-35311",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35311"
    },
    {
      "cve": "CVE-2023-35312",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35312"
    },
    {
      "cve": "CVE-2023-35313",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35313"
    },
    {
      "cve": "CVE-2023-35314",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35314"
    },
    {
      "cve": "CVE-2023-35315",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35315"
    },
    {
      "cve": "CVE-2023-35316",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35316"
    },
    {
      "cve": "CVE-2023-35318",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35318"
    },
    {
      "cve": "CVE-2023-35319",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35319"
    },
    {
      "cve": "CVE-2023-35320",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35320"
    },
    {
      "cve": "CVE-2023-35324",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35324"
    },
    {
      "cve": "CVE-2023-35325",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35325"
    },
    {
      "cve": "CVE-2023-35328",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35328"
    },
    {
      "cve": "CVE-2023-35329",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35329"
    },
    {
      "cve": "CVE-2023-35330",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35330"
    },
    {
      "cve": "CVE-2023-35332",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35332"
    },
    {
      "cve": "CVE-2023-35336",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35336"
    },
    {
      "cve": "CVE-2023-35338",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35338"
    },
    {
      "cve": "CVE-2023-35339",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35339"
    },
    {
      "cve": "CVE-2023-35340",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35340"
    },
    {
      "cve": "CVE-2023-35341",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35341"
    },
    {
      "cve": "CVE-2023-35342",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35342"
    },
    {
      "cve": "CVE-2023-35352",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35352"
    },
    {
      "cve": "CVE-2023-35353",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35353"
    },
    {
      "cve": "CVE-2023-35356",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35356"
    },
    {
      "cve": "CVE-2023-35357",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35357"
    },
    {
      "cve": "CVE-2023-35358",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35358"
    },
    {
      "cve": "CVE-2023-35360",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35360"
    },
    {
      "cve": "CVE-2023-35361",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35361"
    },
    {
      "cve": "CVE-2023-35362",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35362"
    },
    {
      "cve": "CVE-2023-35365",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35365"
    },
    {
      "cve": "CVE-2023-35366",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35366"
    },
    {
      "cve": "CVE-2023-35367",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-35367"
    },
    {
      "cve": "CVE-2023-3600",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-3600"
    },
    {
      "cve": "CVE-2023-36871",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-36871"
    },
    {
      "cve": "CVE-2023-36874",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-36874"
    },
    {
      "cve": "CVE-2023-36884",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-36884"
    },
    {
      "cve": "CVE-2023-37201",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-37201"
    },
    {
      "cve": "CVE-2023-37202",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-37202"
    },
    {
      "cve": "CVE-2023-37203",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-37203"
    },
    {
      "cve": "CVE-2023-37204",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-37204"
    },
    {
      "cve": "CVE-2023-37205",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-37205"
    },
    {
      "cve": "CVE-2023-37206",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-37206"
    },
    {
      "cve": "CVE-2023-37207",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-37207"
    },
    {
      "cve": "CVE-2023-37208",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-37208"
    },
    {
      "cve": "CVE-2023-37209",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-37209"
    },
    {
      "cve": "CVE-2023-37210",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-37210"
    },
    {
      "cve": "CVE-2023-37211",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-37211"
    },
    {
      "cve": "CVE-2023-37212",
      "notes": [
        {
          "category": "description",
          "text": "In Xerox FreeFlow Print Servern mehrerer Versionen existieren mehrere Schwachstellen im Zusammenhang mit bekannten Windows, Java, Apache und Mozilla Firefox Schwachstellen. Ein Angreifer kann diese ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t des Systems zu gef\u00e4hrden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029230",
          "T014888",
          "398363",
          "T015632",
          "T012167"
        ]
      },
      "release_date": "2023-08-09T22:00:00.000+00:00",
      "title": "CVE-2023-37212"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2021-3618",
    "description": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
    "id": "GSD-2021-3618",
    "references": [
      "https://www.suse.com/security/cve/CVE-2021-3618.html",
      "https://advisories.mageia.org/CVE-2021-3618.html",
      "https://security.archlinux.org/CVE-2021-3618",
      "https://ubuntu.com/security/CVE-2021-3618"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-3618"
      ],
      "details": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
      "id": "GSD-2021-3618",
      "modified": "2023-12-13T01:23:34.764948Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2021-3618",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "ALPACA",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "vsftpd 3.0.4, nginx 1.21.0, sendmail 8.17"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-295"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1975623",
            "refsource": "MISC",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975623"
          },
          {
            "name": "https://alpaca-attack.com/",
            "refsource": "MISC",
            "url": "https://alpaca-attack.com/"
          },
          {
            "name": "[debian-lts-announce] 20221122 [SECURITY] [DLA 3203-1] nginx security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.21.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:sendmail:sendmail:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.17",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:vsftpd_project:vsftpd:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "3.0.4",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2021-3618"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-295"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1975623",
              "refsource": "MISC",
              "tags": [
                "Issue Tracking",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975623"
            },
            {
              "name": "https://alpaca-attack.com/",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://alpaca-attack.com/"
            },
            {
              "name": "[debian-lts-announce] 20221122 [SECURITY] [DLA 3203-1] nginx security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 4.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 5.2
        }
      },
      "lastModifiedDate": "2023-02-09T02:03Z",
      "publishedDate": "2022-03-23T20:15Z"
    }
  }
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "777D8DB3-65CF-4A12-BCCE-30849CE07762",
              "versionEndExcluding": "1.21.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sendmail:sendmail:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2E5DF525-823F-49D0-BDD2-6BCE5EE0F66B",
              "versionEndExcluding": "8.17",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vsftpd_project:vsftpd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA84E5A7-7557-4805-902B-E8069F5F4091",
              "versionEndExcluding": "3.0.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
              "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
              "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
              "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer."
    },
    {
      "lang": "es",
      "value": "ALPACA es un ataque de confusi\u00f3n de contenido de protocolo de capa de aplicaci\u00f3n, que explota servidores TLS que implementan diferentes protocolos pero que usan certificados compatibles, como certificados multidominio o comod\u00edn. Un atacante de tipo MiTM que tenga acceso al tr\u00e1fico de la v\u00edctima en la capa TCP/IP puede redirigir el tr\u00e1fico de un subdominio a otro, resultando en a una sesi\u00f3n TLS v\u00e1lida. Esto rompe la autenticaci\u00f3n de TLS y pueden ser posibles los ataques entre protocolos donde el comportamiento de un servicio de protocolo puede comprometer al otro en la capa de aplicaci\u00f3n"
    }
  ],
  "id": "CVE-2021-3618",
  "lastModified": "2024-11-21T06:21:59.713",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-23T20:15:09.833",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://alpaca-attack.com/"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975623"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://alpaca-attack.com/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975623"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Secondary"
    }
  ]
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2021-3618 ALPACA is an application layer protocol content confusion attack exploiting TLS servers implementing different protocols but using compatible certificates such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer. - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2022/msrc_cve-2021-3618.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "ALPACA is an application layer protocol content confusion attack exploiting TLS servers implementing different protocols but using compatible certificates such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
    "tracking": {
      "current_release_date": "2022-04-05T00:00:00.000Z",
      "generator": {
        "date": "2025-10-19T23:23:33.131Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2021-3618",
      "initial_release_date": "2022-03-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2022-04-05T00:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.0",
                "product": {
                  "name": "CBL Mariner 1.0",
                  "product_id": "16820"
                }
              },
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccm1 vsftpd 3.0.5-1",
                "product": {
                  "name": "\u003ccm1 vsftpd 3.0.5-1",
                  "product_id": "5"
                }
              },
              {
                "category": "product_version",
                "name": "cm1 vsftpd 3.0.5-1",
                "product": {
                  "name": "cm1 vsftpd 3.0.5-1",
                  "product_id": "18882"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 vsftpd 3.0.5-1",
                "product": {
                  "name": "\u003ccbl2 vsftpd 3.0.5-1",
                  "product_id": "2"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 vsftpd 3.0.5-1",
                "product": {
                  "name": "cbl2 vsftpd 3.0.5-1",
                  "product_id": "18885"
                }
              }
            ],
            "category": "product_name",
            "name": "vsftpd"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccm1 nginx 1.20.1-3",
                "product": {
                  "name": "\u003ccm1 nginx 1.20.1-3",
                  "product_id": "4"
                }
              },
              {
                "category": "product_version",
                "name": "cm1 nginx 1.20.1-3",
                "product": {
                  "name": "cm1 nginx 1.20.1-3",
                  "product_id": "18883"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 nginx 1.20.2-2",
                "product": {
                  "name": "\u003ccbl2 nginx 1.20.2-2",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 nginx 1.20.2-2",
                "product": {
                  "name": "cbl2 nginx 1.20.2-2",
                  "product_id": "18886"
                }
              }
            ],
            "category": "product_name",
            "name": "nginx"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 sendmail 8.15.2-46",
                "product": {
                  "name": "\u003ccbl2 sendmail 8.15.2-46",
                  "product_id": "3"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 sendmail 8.15.2-46",
                "product": {
                  "name": "cbl2 sendmail 8.15.2-46",
                  "product_id": "18884"
                }
              }
            ],
            "category": "product_name",
            "name": "sendmail"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccm1 vsftpd 3.0.5-1 as a component of CBL Mariner 1.0",
          "product_id": "16820-5"
        },
        "product_reference": "5",
        "relates_to_product_reference": "16820"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cm1 vsftpd 3.0.5-1 as a component of CBL Mariner 1.0",
          "product_id": "18882-16820"
        },
        "product_reference": "18882",
        "relates_to_product_reference": "16820"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccm1 nginx 1.20.1-3 as a component of CBL Mariner 1.0",
          "product_id": "16820-4"
        },
        "product_reference": "4",
        "relates_to_product_reference": "16820"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cm1 nginx 1.20.1-3 as a component of CBL Mariner 1.0",
          "product_id": "18883-16820"
        },
        "product_reference": "18883",
        "relates_to_product_reference": "16820"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 sendmail 8.15.2-46 as a component of CBL Mariner 2.0",
          "product_id": "17086-3"
        },
        "product_reference": "3",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 sendmail 8.15.2-46 as a component of CBL Mariner 2.0",
          "product_id": "18884-17086"
        },
        "product_reference": "18884",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 vsftpd 3.0.5-1 as a component of CBL Mariner 2.0",
          "product_id": "17086-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 vsftpd 3.0.5-1 as a component of CBL Mariner 2.0",
          "product_id": "18885-17086"
        },
        "product_reference": "18885",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 nginx 1.20.2-2 as a component of CBL Mariner 2.0",
          "product_id": "17086-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 nginx 1.20.2-2 as a component of CBL Mariner 2.0",
          "product_id": "18886-17086"
        },
        "product_reference": "18886",
        "relates_to_product_reference": "17086"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3618",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "general",
          "text": "redhat",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "18882-16820",
          "18883-16820",
          "18884-17086",
          "18885-17086",
          "18886-17086"
        ],
        "known_affected": [
          "16820-5",
          "16820-4",
          "17086-3",
          "17086-2",
          "17086-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2021-3618 ALPACA is an application layer protocol content confusion attack exploiting TLS servers implementing different protocols but using compatible certificates such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer. - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2022/msrc_cve-2021-3618.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-04-05T00:00:00.000Z",
          "details": "3.0.5-1:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "16820-5",
            "17086-2"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2022-04-05T00:00:00.000Z",
          "details": "1.20.1-3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "16820-4"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2022-04-05T00:00:00.000Z",
          "details": "8.15.2-46:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-3"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2022-04-05T00:00:00.000Z",
          "details": "1.20.2-2:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.4,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "16820-5",
            "16820-4",
            "17086-3",
            "17086-2",
            "17086-1"
          ]
        }
      ],
      "title": "ALPACA is an application layer protocol content confusion attack exploiting TLS servers implementing different protocols but using compatible certificates such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer."
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-3618"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-23T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim\u0027s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.",
  "id": "GHSA-r9r5-jxp7-whr4",
  "modified": "2022-04-05T00:01:06Z",
  "published": "2022-03-24T00:00:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3618"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nginx/nginx/commit/173f16f736c10eae46cd15dd861b04b82d91a37a"
    },
    {
      "type": "WEB",
      "url": "https://alpaca-attack.com"
    },
    {
      "type": "WEB",
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991328"
    },
    {
      "type": "WEB",
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991329"
    },
    {
      "type": "WEB",
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991331"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975623"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html"
    },
    {
      "type": "WEB",
      "url": "https://ubuntu.com/security/CVE-2021-3618"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}