FKIE_CVE-2024-3094

Vulnerability from fkie_nvd - Published: 2024-03-29 17:15 - Updated: 2025-08-19 01:15
Severity ?
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
References
secalert@redhat.comhttps://access.redhat.com/security/cve/CVE-2024-3094Vendor Advisory
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2272210Issue Tracking, Vendor Advisory
secalert@redhat.comhttps://www.openwall.com/lists/oss-security/2024/03/29/4Mailing List
secalert@redhat.comhttps://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-usersVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/03/29/10
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/03/29/12
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/03/29/4
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/03/29/5
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/03/29/8
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/03/30/12
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/03/30/27
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/03/30/36
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/03/30/5
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/04/16/5
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/security/cve/CVE-2024-3094Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/
af854a3a-2127-422b-91ae-364da2661108https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://aws.amazon.com/security/security-bulletins/AWS-2024-002/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz
af854a3a-2127-422b-91ae-364da2661108https://boehs.org/node/everything-i-know-about-the-xz-backdoorThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugs.gentoo.org/928134Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=2272210Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.suse.com/show_bug.cgi?id=1222124Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/advisories/GHSA-rxwq-x6h5-x525Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/amlweems/xzbot
af854a3a-2127-422b-91ae-364da2661108https://github.com/karcherm/xz-malwareThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://gynvael.coldwind.pl/?lang=en&id=782Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-security-announce/2024/msg00057.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lwn.net/Articles/967180/Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://news.ycombinator.com/item?id=39865810Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://news.ycombinator.com/item?id=39877267Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://news.ycombinator.com/item?id=39895344
af854a3a-2127-422b-91ae-364da2661108https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://research.swtch.com/xz-script
af854a3a-2127-422b-91ae-364da2661108https://research.swtch.com/xz-timeline
af854a3a-2127-422b-91ae-364da2661108https://security-tracker.debian.org/tracker/CVE-2024-3094Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.alpinelinux.org/vuln/CVE-2024-3094Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.archlinux.org/CVE-2024-3094Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240402-0001/
af854a3a-2127-422b-91ae-364da2661108https://tukaani.org/xz-backdoor/Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://twitter.com/LetsDefendIO/status/1774804387417751958Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://twitter.com/debian/status/1774219194638409898Press/Media Coverage
af854a3a-2127-422b-91ae-364da2661108https://twitter.com/infosecb/status/1774595540233167206Press/Media Coverage
af854a3a-2127-422b-91ae-364da2661108https://twitter.com/infosecb/status/1774597228864139400Press/Media Coverage
af854a3a-2127-422b-91ae-364da2661108https://ubuntu.com/security/CVE-2024-3094Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.binarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-docker-images
af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utilsThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.kali.org/blog/about-the-xz-backdoor/
af854a3a-2127-422b-91ae-364da2661108https://www.openwall.com/lists/oss-security/2024/03/29/4Mailing List
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-usersVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utilsThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.theregister.com/2024/03/29/malicious_backdoor_xz/Press/Media Coverage
af854a3a-2127-422b-91ae-364da2661108https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094
af854a3a-2127-422b-91ae-364da2661108https://xeiaso.net/notes/2024/xz-vuln/Third Party Advisory
Impacted products
Vendor Product Version
tukaani xz 5.6.0
tukaani xz 5.6.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "73F1DAD7-F362-4C5B-B980-2E5313C369DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tukaani:xz:5.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "55782A0B-B9C5-4536-A885-84CAB7029C09",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \r\nThrough a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library."
    },
    {
      "lang": "es",
      "value": "Se descubri\u00f3 c\u00f3digo malicioso en los archivos tar ascendentes de xz, a partir de la versi\u00f3n 5.6.0. A trav\u00e9s de una serie de ofuscaciones complejas, el proceso de compilaci\u00f3n de liblzma extrae un archivo objeto premanipulado de un archivo de prueba disfrazado existente en el c\u00f3digo fuente, que luego se utiliza para modificar funciones espec\u00edficas en el c\u00f3digo de liblzma. Esto da como resultado una librer\u00eda liblzma modificada que puede ser utilizada por cualquier software vinculado a esta librer\u00eda, interceptando y modificando la interacci\u00f3n de datos con esta librer\u00eda."
    }
  ],
  "id": "CVE-2024-3094",
  "lastModified": "2025-08-19T01:15:57.407",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-03-29T17:15:21.150",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/security/cve/CVE-2024-3094"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272210"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Mailing List"
      ],
      "url": "https://www.openwall.com/lists/oss-security/2024/03/29/4"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2024/03/29/10"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2024/03/29/12"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2024/03/29/4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2024/03/29/5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2024/03/29/8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2024/03/30/12"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2024/03/30/27"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2024/03/30/36"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2024/03/30/5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2024/04/16/5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/security/cve/CVE-2024-3094"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://aws.amazon.com/security/security-bulletins/AWS-2024-002/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://boehs.org/node/everything-i-know-about-the-xz-backdoor"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugs.gentoo.org/928134"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272210"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1222124"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/advisories/GHSA-rxwq-x6h5-x525"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/amlweems/xzbot"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/karcherm/xz-malware"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://gynvael.coldwind.pl/?lang=en\u0026id=782"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-security-announce/2024/msg00057.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://lwn.net/Articles/967180/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://news.ycombinator.com/item?id=39865810"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://news.ycombinator.com/item?id=39877267"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://news.ycombinator.com/item?id=39895344"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://research.swtch.com/xz-script"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://research.swtch.com/xz-timeline"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security-tracker.debian.org/tracker/CVE-2024-3094"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.alpinelinux.org/vuln/CVE-2024-3094"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.archlinux.org/CVE-2024-3094"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20240402-0001/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://tukaani.org/xz-backdoor/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://twitter.com/LetsDefendIO/status/1774804387417751958"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Press/Media Coverage"
      ],
      "url": "https://twitter.com/debian/status/1774219194638409898"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Press/Media Coverage"
      ],
      "url": "https://twitter.com/infosecb/status/1774595540233167206"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Press/Media Coverage"
      ],
      "url": "https://twitter.com/infosecb/status/1774597228864139400"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://ubuntu.com/security/CVE-2024-3094"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.binarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-docker-images"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.kali.org/blog/about-the-xz-backdoor/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "https://www.openwall.com/lists/oss-security/2024/03/29/4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Press/Media Coverage"
      ],
      "url": "https://www.theregister.com/2024/03/29/malicious_backdoor_xz/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://xeiaso.net/notes/2024/xz-vuln/"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-506"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.