Vulnerability from csaf_opensuse
Published
2024-12-11 00:00
Modified
2024-12-11 00:00
Summary
govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media

Notes

Title of the patch
govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media
Description of the patch
These are all security issues fixed in the govulncheck-vulndb-0.0.20241209T183251-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-14567
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "These are all security issues fixed in the govulncheck-vulndb-0.0.20241209T183251-1.1 package on the GA media of openSUSE Tumbleweed.",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-Tumbleweed-2024-14567",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_14567-1.json",
         },
         {
            category: "self",
            summary: "URL for openSUSE-SU-2024:14567-1",
            url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/",
         },
         {
            category: "self",
            summary: "E-Mail link for openSUSE-SU-2024:14567-1",
            url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-10220 page",
            url: "https://www.suse.com/security/cve/CVE-2024-10220/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-36620 page",
            url: "https://www.suse.com/security/cve/CVE-2024-36620/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-36621 page",
            url: "https://www.suse.com/security/cve/CVE-2024-36621/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-36623 page",
            url: "https://www.suse.com/security/cve/CVE-2024-36623/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-37820 page",
            url: "https://www.suse.com/security/cve/CVE-2024-37820/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-43784 page",
            url: "https://www.suse.com/security/cve/CVE-2024-43784/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-45719 page",
            url: "https://www.suse.com/security/cve/CVE-2024-45719/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-50948 page",
            url: "https://www.suse.com/security/cve/CVE-2024-50948/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-52003 page",
            url: "https://www.suse.com/security/cve/CVE-2024-52003/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-52529 page",
            url: "https://www.suse.com/security/cve/CVE-2024-52529/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-52801 page",
            url: "https://www.suse.com/security/cve/CVE-2024-52801/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-53259 page",
            url: "https://www.suse.com/security/cve/CVE-2024-53259/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-53264 page",
            url: "https://www.suse.com/security/cve/CVE-2024-53264/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-53858 page",
            url: "https://www.suse.com/security/cve/CVE-2024-53858/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-53862 page",
            url: "https://www.suse.com/security/cve/CVE-2024-53862/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-54131 page",
            url: "https://www.suse.com/security/cve/CVE-2024-54131/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-54132 page",
            url: "https://www.suse.com/security/cve/CVE-2024-54132/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-6156 page",
            url: "https://www.suse.com/security/cve/CVE-2024-6156/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-6219 page",
            url: "https://www.suse.com/security/cve/CVE-2024-6219/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-6538 page",
            url: "https://www.suse.com/security/cve/CVE-2024-6538/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-8676 page",
            url: "https://www.suse.com/security/cve/CVE-2024-8676/",
         },
      ],
      title: "govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media",
      tracking: {
         current_release_date: "2024-12-11T00:00:00Z",
         generator: {
            date: "2024-12-11T00:00:00Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2024:14567-1",
         initial_release_date: "2024-12-11T00:00:00Z",
         revision_history: [
            {
               date: "2024-12-11T00:00:00Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                        product: {
                           name: "govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                           product_id: "govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                        product: {
                           name: "govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                           product_id: "govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                        product: {
                           name: "govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                           product_id: "govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
                        product: {
                           name: "govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
                           product_id: "govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "openSUSE Tumbleweed",
                        product: {
                           name: "openSUSE Tumbleweed",
                           product_id: "openSUSE Tumbleweed",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:tumbleweed",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            },
            product_reference: "govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            },
            product_reference: "govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "govulncheck-vulndb-0.0.20241209T183251-1.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            },
            product_reference: "govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            },
            product_reference: "govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2024-10220",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-10220",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-10220",
               url: "https://www.suse.com/security/cve/CVE-2024-10220",
            },
            {
               category: "external",
               summary: "SUSE Bug 1233583 for CVE-2024-10220",
               url: "https://bugzilla.suse.com/1233583",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-10220",
      },
      {
         cve: "CVE-2024-36620",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-36620",
            },
         ],
         notes: [
            {
               category: "general",
               text: "moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-36620",
               url: "https://www.suse.com/security/cve/CVE-2024-36620",
            },
            {
               category: "external",
               summary: "SUSE Bug 1234127 for CVE-2024-36620",
               url: "https://bugzilla.suse.com/1234127",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-36620",
      },
      {
         cve: "CVE-2024-36621",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-36621",
            },
         ],
         notes: [
            {
               category: "general",
               text: "moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-36621",
               url: "https://www.suse.com/security/cve/CVE-2024-36621",
            },
            {
               category: "external",
               summary: "SUSE Bug 1234131 for CVE-2024-36621",
               url: "https://bugzilla.suse.com/1234131",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-36621",
      },
      {
         cve: "CVE-2024-36623",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-36623",
            },
         ],
         notes: [
            {
               category: "general",
               text: "moby v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-36623",
               url: "https://www.suse.com/security/cve/CVE-2024-36623",
            },
            {
               category: "external",
               summary: "SUSE Bug 1234132 for CVE-2024-36623",
               url: "https://bugzilla.suse.com/1234132",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-36623",
      },
      {
         cve: "CVE-2024-37820",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-37820",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-37820",
               url: "https://www.suse.com/security/cve/CVE-2024-37820",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-37820",
      },
      {
         cve: "CVE-2024-43784",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-43784",
            },
         ],
         notes: [
            {
               category: "general",
               text: "lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit all of the previous user's credentials. This issue has been addressed in release version 1.33.0 and all users are advised to upgrade. The only known workaround for those who cannot upgrade is to not reuse usernames.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-43784",
               url: "https://www.suse.com/security/cve/CVE-2024-43784",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-43784",
      },
      {
         cve: "CVE-2024-45719",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-45719",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Inadequate Encryption Strength vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.4.0.\n\nThe ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable.\nUsers are recommended to upgrade to version 1.4.1, which fixes the issue.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-45719",
               url: "https://www.suse.com/security/cve/CVE-2024-45719",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "low",
            },
         ],
         title: "CVE-2024-45719",
      },
      {
         cve: "CVE-2024-50948",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-50948",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An issue in mochiMQTT v2.6.3 allows attackers to cause a Denial of Service (DoS) via a crafted request.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-50948",
               url: "https://www.suse.com/security/cve/CVE-2024-50948",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-50948",
      },
      {
         cve: "CVE-2024-52003",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-52003",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-52003",
               url: "https://www.suse.com/security/cve/CVE-2024-52003",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-52003",
      },
      {
         cve: "CVE-2024-52529",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-52529",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that selects a Layer 3 destination and a port range `AND` 2. A Layer 7 allow policy that selects a specific port within the first policy's range the Layer 7 enforcement would not occur for the traffic selected by the Layer 7 policy. This issue only affects users who use Cilium's port range functionality, which was introduced in Cilium v1.16. This issue is patched in PR #35150. This issue affects Cilium v1.16 between v1.16.0 and v1.16.3 inclusive. This issue is patched in Cilium v1.16.4. Users are advised to upgrade. Users with network policies that match the pattern described above can work around the issue by rewriting any policies that use port ranges to individually specify the ports permitted for traffic.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-52529",
               url: "https://www.suse.com/security/cve/CVE-2024-52529",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-52529",
      },
      {
         cve: "CVE-2024-52801",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-52801",
            },
         ],
         notes: [
            {
               category: "general",
               text: "sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically secure. This issue was fixed in version v2.6.4, where cookies are opaque and cryptographically secure strings. All users are advised to upgrade. There are no known workarounds for this vulnerability.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-52801",
               url: "https://www.suse.com/security/cve/CVE-2024-52801",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-52801",
      },
      {
         cve: "CVE-2024-53259",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-53259",
            },
         ],
         notes: [
            {
               category: "general",
               text: "quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a \"message too large\" error on sendmsg, i.e. when quic-go attempts to send a packet that exceeds the MTU claimed in that ICMP packet. By setting this value to smaller than 1200 bytes (the minimum MTU for QUIC), the attacker can disrupt a QUIC connection. Crucially, this can be done after completion of the handshake, thereby circumventing any TCP fallback that might be implemented on the application layer (for example, many browsers fall back to HTTP over TCP if they're unable to establish a QUIC connection). The attacker needs to at least know the client's IP and port tuple to mount an attack. This vulnerability is fixed in 0.48.2.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-53259",
               url: "https://www.suse.com/security/cve/CVE-2024-53259",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-53259",
      },
      {
         cve: "CVE-2024-53264",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-53264",
            },
         ],
         notes: [
            {
               category: "general",
               text: "bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the \"next\" parameter. The loading endpoint accepts and uses an unvalidated \"next\" parameter for redirects. Ex. visiting: `/loading?next=https://google.com` while authenticated will cause the page will redirect to google.com. This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites. This issue has been addressed in version 1.5.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-53264",
               url: "https://www.suse.com/security/cve/CVE-2024-53264",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-53264",
      },
      {
         cve: "CVE-2024-53858",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-53858",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The gh cli is GitHub's official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing `git` submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several `gh` commands used to clone a repository with submodules from a non-GitHub host including `gh repo clone`, `gh repo fork`, and `gh pr checkout`. These GitHub CLI commands invoke git with instructions to retrieve authentication tokens using the `credential.helper` configuration variable for any host encountered. Prior to version `2.63.0`, hosts other than GitHub.com and ghe.com are treated as GitHub Enterprise Server hosts and have tokens sourced from the following environment variables before falling back to host-specific tokens stored within system-specific secured storage: 1. `GITHUB_ENTERPRISE_TOKEN`, 2. `GH_ENTERPRISE_TOKEN` and 3. `GITHUB_TOKEN` when the `CODESPACES` environment variable is set. The result being `git` sending authentication tokens when cloning submodules. In version `2.63.0`, these GitHub CLI commands will limit the hosts for which `gh` acts as a credential helper to source authentication tokens. Additionally, `GITHUB_TOKEN` will only be used for GitHub.com and ghe.com. Users are advised to upgrade. Additionally users are advised to revoke authentication tokens used with the GitHub CLI and to review their personal security log and any relevant audit logs for actions associated with their account or enterprise",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-53858",
               url: "https://www.suse.com/security/cve/CVE-2024-53858",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-53858",
      },
      {
         cve: "CVE-2024-53862",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-53862",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using `--auth-mode=client`, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: `/api/v1/workflows/{namespace}/{name}` or when using `--auth-mode=sso`, all Archived Workflows can be retrieved with a valid token via the GET Workflow endpoint: `/api/v1/workflows/{namespace}/{name}`. No authentication is performed by the Server itself on `client` tokens. Authentication & authorization is instead delegated to the k8s API server. However, the Workflow Archive does not interact with k8s, and so any token that looks valid will be considered authenticated, even if it is not a k8s token or even if the token has no RBAC for Argo. To handle the lack of pass-through k8s authN/authZ, the Workflow Archive specifically does the equivalent of a `kubectl auth can-i` check for respective methods. In 3.5.7 and 3.5.8, the auth check was accidentally removed on the GET Workflow endpoint's fallback to archived workflows on these lines, allowing archived workflows to be retrieved with a fake token. This vulnerability is fixed in 3.6.2 and 3.5.13.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-53862",
               url: "https://www.suse.com/security/cve/CVE-2024-53862",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-53862",
      },
      {
         cve: "CVE-2024-54131",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-54131",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The Kolide Agent (aka: Launcher) is the lightweight agent designed to work with Kolide's service. An implementation bug in the Kolide Agent (known as `launcher`) allows for local privilege escalation to the SYSTEM user on Windows 10 and 11. The bug was introduced in version 1.5.3 when launcher started storing upgraded binaries in the ProgramData directory. This move to the new directory meant the launcher root directory inherited default permissions that are not as strict as the previous location. These incorrect default permissions in conjunction with an omitted SystemDrive environmental variable (when launcher starts osqueryd), allows a malicious actor with access to the local Windows device to successfully place an arbitrary DLL into the osqueryd process's search path. Under some circumstances, this DLL will be executed when osqueryd performs a WMI query. This combination of events could then allow the attacker to escalate their privileges to SYSTEM. Impacted versions include versions >= 1.5.3 and the fix has been released in 1.12.3.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-54131",
               url: "https://www.suse.com/security/cve/CVE-2024-54131",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-54131",
      },
      {
         cve: "CVE-2024-54132",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-54132",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The GitHub CLI is GitHub's official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact's download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-54132",
               url: "https://www.suse.com/security/cve/CVE-2024-54132",
            },
            {
               category: "external",
               summary: "SUSE Bug 1234230 for CVE-2024-54132",
               url: "https://bugzilla.suse.com/1234230",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-54132",
      },
      {
         cve: "CVE-2024-6156",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-6156",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-6156",
               url: "https://www.suse.com/security/cve/CVE-2024-6156",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "low",
            },
         ],
         title: "CVE-2024-6156",
      },
      {
         cve: "CVE-2024-6219",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-6219",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-6219",
               url: "https://www.suse.com/security/cve/CVE-2024-6219",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "low",
            },
         ],
         title: "CVE-2024-6219",
      },
      {
         cve: "CVE-2024-6538",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-6538",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to clients due to network filtering. Leveraging such an attack vector, the attacker can have an impact on other services and potentially disclose information or have other nefarious effects on the system.\nThe /api/dev-console/proxy/internet endpoint on the OpenShit Console allows authenticated users to have the console's pod perform arbitrary and fully controlled HTTP(s) requests. The full response to these requests is returned by the endpoint.\nWhile the name of this endpoint suggests the requests are only bound to the internet, no such checks are in place. An authenticated user can therefore ask the console to perform arbitrary HTTP requests from outside the cluster to a service inside the cluster.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-6538",
               url: "https://www.suse.com/security/cve/CVE-2024-6538",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-6538",
      },
      {
         cve: "CVE-2024-8676",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-8676",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-8676",
               url: "https://www.suse.com/security/cve/CVE-2024-8676",
            },
            {
               category: "external",
               summary: "SUSE Bug 1233812 for CVE-2024-8676",
               url: "https://bugzilla.suse.com/1233812",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-12-11T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-8676",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.