GSD-2019-11068

Vulnerability from gsd - Updated: 2019-04-22 00:00
Details
Nokogiri v1.10.3 has been released. This is a security release. It addresses a CVE in upstream libxslt rated as "Priority: medium" by Canonical, and "NVD Severity: high" by Debian. More details are available below. If you're using your distro's system libraries, rather than Nokogiri's vendored libraries, there's no security need to upgrade at this time, though you may want to check with your distro whether they've patched this (Canonical has patched Ubuntu packages). Note that this patch is not yet (as of 2019-04-22) in an upstream release of libxslt. Full details about the security update are available in Github Issue [#1892] https://github.com/sparklemotion/nokogiri/issues/1892. --- CVE-2019-11068 Permalinks are: - Canonical: https://people.canonical.com/~ubuntu-security/cve/CVE-2019-11068 - Debian: https://security-tracker.debian.org/tracker/CVE-2019-11068 Description: > libxslt through 1.1.33 allows bypass of a protection mechanism > because callers of xsltCheckRead and xsltCheckWrite permit access > even upon receiving a -1 error code. xsltCheckRead can return -1 for > a crafted URL that is not actually invalid and is subsequently > loaded. Canonical rates this as "Priority: Medium". Debian rates this as "NVD Severity: High (attack range: remote)".
Aliases
Aliases
CVE-2019-11068
To clipboard 

{
  "GSD": {
    "alias": "CVE-2019-11068",
    "description": "libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.",
    "id": "GSD-2019-11068",
    "references": [
      "https://www.suse.com/security/cve/CVE-2019-11068.html",
      "https://access.redhat.com/errata/RHSA-2020:4464",
      "https://access.redhat.com/errata/RHSA-2020:4005",
      "https://ubuntu.com/security/CVE-2019-11068",
      "https://advisories.mageia.org/CVE-2019-11068.html",
      "https://alas.aws.amazon.com/cve/html/CVE-2019-11068.html",
      "https://linux.oracle.com/cve/CVE-2019-11068.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "nokogiri",
            "purl": "pkg:gem/nokogiri"
          }
        }
      ],
      "aliases": [
        "CVE-2019-11068",
        "GHSA-qxcg-xjjg-66mj"
      ],
      "details": "Nokogiri v1.10.3 has been released.\n\nThis is a security release. It addresses a CVE in upstream libxslt rated as\n\"Priority: medium\" by Canonical, and \"NVD Severity: high\" by Debian. More\ndetails are available below.\n\nIf you\u0027re using your distro\u0027s system libraries, rather than Nokogiri\u0027s\nvendored libraries, there\u0027s no security need to upgrade at this time, though\nyou may want to check with your distro whether they\u0027ve patched this\n(Canonical has patched Ubuntu packages). Note that this patch is not yet (as\nof 2019-04-22) in an upstream release of libxslt.\n\nFull details about the security update are available in Github Issue\n[#1892] https://github.com/sparklemotion/nokogiri/issues/1892.\n\n---\n\nCVE-2019-11068\n\nPermalinks are:\n- Canonical: https://people.canonical.com/~ubuntu-security/cve/CVE-2019-11068\n- Debian: https://security-tracker.debian.org/tracker/CVE-2019-11068\n\nDescription:\n\n\u003e libxslt through 1.1.33 allows bypass of a protection mechanism\n\u003e because callers of xsltCheckRead and xsltCheckWrite permit access\n\u003e even upon receiving a -1 error code. xsltCheckRead can return -1 for\n\u003e a crafted URL that is not actually invalid and is subsequently\n\u003e loaded.\n\nCanonical rates this as \"Priority: Medium\".\n\nDebian rates this as \"NVD Severity: High (attack range: remote)\".\n",
      "id": "GSD-2019-11068",
      "modified": "2019-04-22T00:00:00.000Z",
      "published": "2019-04-22T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/sparklemotion/nokogiri/issues/1892"
        },
        {
          "type": "WEB",
          "url": "https://groups.google.com/forum/#!msg/ruby-security-ann/_y80o1zZlOs/k4SDX6hoAAAJ"
        },
        {
          "type": "WEB",
          "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 9.8,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Nokogiri gem, via libxslt, is affected by improper access control vulnerability"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2019-11068",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6",
            "refsource": "MISC",
            "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6"
          },
          {
            "name": "[debian-lts-announce] 20190415 [SECURITY] [DLA 1756-1] libxslt security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00016.html"
          },
          {
            "name": "USN-3947-2",
            "refsource": "UBUNTU",
            "url": "https://usn.ubuntu.com/3947-2/"
          },
          {
            "name": "[oss-security] 20190422 Nokogiri security update v1.10.3",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2019/04/22/1"
          },
          {
            "name": "USN-3947-1",
            "refsource": "UBUNTU",
            "url": "https://usn.ubuntu.com/3947-1/"
          },
          {
            "name": "[oss-security] 20190423 Re: Nokogiri security update v1.10.3",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2019/04/23/5"
          },
          {
            "name": "openSUSE-SU-2019:1433",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00048.html"
          },
          {
            "name": "openSUSE-SU-2019:1430",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00053.html"
          },
          {
            "name": "openSUSE-SU-2019:1428",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00052.html"
          },
          {
            "name": "openSUSE-SU-2019:1527",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html"
          },
          {
            "name": "FEDORA-2019-e21c77ffae",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/"
          },
          {
            "name": "FEDORA-2019-320d5295fc",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/"
          },
          {
            "name": "FEDORA-2019-e74d639587",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/"
          },
          {
            "name": "openSUSE-SU-2019:1824",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html"
          },
          {
            "name": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
            "refsource": "MISC",
            "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20191017-0001/",
            "refsource": "CONFIRM",
            "url": "https://security.netapp.com/advisory/ntap-20191017-0001/"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2019-11068",
      "cvss_v3": 9.8,
      "date": "2019-04-22",
      "description": "Nokogiri v1.10.3 has been released.\n\nThis is a security release. It addresses a CVE in upstream libxslt rated as\n\"Priority: medium\" by Canonical, and \"NVD Severity: high\" by Debian. More\ndetails are available below.\n\nIf you\u0027re using your distro\u0027s system libraries, rather than Nokogiri\u0027s\nvendored libraries, there\u0027s no security need to upgrade at this time, though\nyou may want to check with your distro whether they\u0027ve patched this\n(Canonical has patched Ubuntu packages). Note that this patch is not yet (as\nof 2019-04-22) in an upstream release of libxslt.\n\nFull details about the security update are available in Github Issue\n[#1892] https://github.com/sparklemotion/nokogiri/issues/1892.\n\n---\n\nCVE-2019-11068\n\nPermalinks are:\n- Canonical: https://people.canonical.com/~ubuntu-security/cve/CVE-2019-11068\n- Debian: https://security-tracker.debian.org/tracker/CVE-2019-11068\n\nDescription:\n\n\u003e libxslt through 1.1.33 allows bypass of a protection mechanism\n\u003e because callers of xsltCheckRead and xsltCheckWrite permit access\n\u003e even upon receiving a -1 error code. xsltCheckRead can return -1 for\n\u003e a crafted URL that is not actually invalid and is subsequently\n\u003e loaded.\n\nCanonical rates this as \"Priority: Medium\".\n\nDebian rates this as \"NVD Severity: High (attack range: remote)\".\n",
      "gem": "nokogiri",
      "ghsa": "qxcg-xjjg-66mj",
      "patched_versions": [
        "\u003e= 1.10.3"
      ],
      "related": {
        "url": [
          "https://groups.google.com/forum/#!msg/ruby-security-ann/_y80o1zZlOs/k4SDX6hoAAAJ",
          "https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6"
        ]
      },
      "title": "Nokogiri gem, via libxslt, is affected by improper access control vulnerability",
      "url": "https://github.com/sparklemotion/nokogiri/issues/1892"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c1.10.4",
          "affected_versions": "All versions up to 1.1.33",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2019-06-14",
          "description": "The libxslt binary, which is included in nokogiri, allows bypass of a protection mechanism because callers of `xsltCheckRead` and `xsltCheckWrite` permit access even upon receiving a -1 error code. `xsltCheckRead` can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.",
          "fixed_versions": [
            "1.10.4"
          ],
          "identifier": "CVE-2019-11068",
          "identifiers": [
            "CVE-2019-11068"
          ],
          "not_impacted": "All versions after 1.1.33",
          "package_slug": "gem/nokogiri",
          "pubdate": "2019-04-10",
          "solution": "Upgrade to version 1.2.0 or above.",
          "title": "Bypass of a protection mechanism in libxslt",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2019-11068",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068",
            "https://github.com/sparklemotion/nokogiri/issues/1892",
            "https://people.canonical.com/~ubuntu-security/cve/CVE-2019-11068",
            "https://security-tracker.debian.org/tracker/CVE-2019-11068"
          ],
          "uuid": "1a2e2e6e-67ba-4142-bfa1-3391f5416e4c"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:xmlsoft:libxslt:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.1.33",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:jdk:8.0:update_221:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:e-series_santricity_management_plug-ins:-:*:*:*:*:vmware_vcenter:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "11.70.2",
                "versionStartIncluding": "11.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-11068"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6"
            },
            {
              "name": "[debian-lts-announce] 20190415 [SECURITY] [DLA 1756-1] libxslt security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00016.html"
            },
            {
              "name": "USN-3947-2",
              "refsource": "UBUNTU",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://usn.ubuntu.com/3947-2/"
            },
            {
              "name": "[oss-security] 20190422 Nokogiri security update v1.10.3",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2019/04/22/1"
            },
            {
              "name": "USN-3947-1",
              "refsource": "UBUNTU",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://usn.ubuntu.com/3947-1/"
            },
            {
              "name": "[oss-security] 20190423 Re: Nokogiri security update v1.10.3",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2019/04/23/5"
            },
            {
              "name": "openSUSE-SU-2019:1433",
              "refsource": "SUSE",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00048.html"
            },
            {
              "name": "openSUSE-SU-2019:1430",
              "refsource": "SUSE",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00053.html"
            },
            {
              "name": "openSUSE-SU-2019:1428",
              "refsource": "SUSE",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00052.html"
            },
            {
              "name": "openSUSE-SU-2019:1527",
              "refsource": "SUSE",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html"
            },
            {
              "name": "FEDORA-2019-e21c77ffae",
              "refsource": "FEDORA",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/"
            },
            {
              "name": "FEDORA-2019-320d5295fc",
              "refsource": "FEDORA",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/"
            },
            {
              "name": "FEDORA-2019-e74d639587",
              "refsource": "FEDORA",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/"
            },
            {
              "name": "openSUSE-SU-2019:1824",
              "refsource": "SUSE",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20191017-0001/",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.netapp.com/advisory/ntap-20191017-0001/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-03-24T18:27Z",
      "publishedDate": "2019-04-10T20:29Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.