{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "These are all security issues fixed in the velociraptor-0.7.0.4.git142.862ef23-1.1 package on the GA media of openSUSE Tumbleweed.",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-Tumbleweed-2025-14663",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_14663-1.json",
         },
         {
            category: "self",
            summary: "URL for openSUSE-SU-2025:14663-1",
            url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/",
         },
         {
            category: "self",
            summary: "E-Mail link for openSUSE-SU-2025:14663-1",
            url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2023-1732 page",
            url: "https://www.suse.com/security/cve/CVE-2023-1732/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2023-44270 page",
            url: "https://www.suse.com/security/cve/CVE-2023-44270/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2023-45133 page",
            url: "https://www.suse.com/security/cve/CVE-2023-45133/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2023-45683 page",
            url: "https://www.suse.com/security/cve/CVE-2023-45683/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2023-46234 page",
            url: "https://www.suse.com/security/cve/CVE-2023-46234/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-21538 page",
            url: "https://www.suse.com/security/cve/CVE-2024-21538/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-23331 page",
            url: "https://www.suse.com/security/cve/CVE-2024-23331/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-24786 page",
            url: "https://www.suse.com/security/cve/CVE-2024-24786/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-28180 page",
            url: "https://www.suse.com/security/cve/CVE-2024-28180/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-31207 page",
            url: "https://www.suse.com/security/cve/CVE-2024-31207/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-37298 page",
            url: "https://www.suse.com/security/cve/CVE-2024-37298/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-4067 page",
            url: "https://www.suse.com/security/cve/CVE-2024-4067/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-4068 page",
            url: "https://www.suse.com/security/cve/CVE-2024-4068/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-42459 page",
            url: "https://www.suse.com/security/cve/CVE-2024-42459/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-42460 page",
            url: "https://www.suse.com/security/cve/CVE-2024-42460/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-42461 page",
            url: "https://www.suse.com/security/cve/CVE-2024-42461/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-45296 page",
            url: "https://www.suse.com/security/cve/CVE-2024-45296/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-45338 page",
            url: "https://www.suse.com/security/cve/CVE-2024-45338/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-45811 page",
            url: "https://www.suse.com/security/cve/CVE-2024-45811/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-45812 page",
            url: "https://www.suse.com/security/cve/CVE-2024-45812/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-47068 page",
            url: "https://www.suse.com/security/cve/CVE-2024-47068/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-47875 page",
            url: "https://www.suse.com/security/cve/CVE-2024-47875/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-48948 page",
            url: "https://www.suse.com/security/cve/CVE-2024-48948/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-48949 page",
            url: "https://www.suse.com/security/cve/CVE-2024-48949/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-51744 page",
            url: "https://www.suse.com/security/cve/CVE-2024-51744/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-55565 page",
            url: "https://www.suse.com/security/cve/CVE-2024-55565/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-6104 page",
            url: "https://www.suse.com/security/cve/CVE-2024-6104/",
         },
      ],
      title: "velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media",
      tracking: {
         current_release_date: "2025-01-17T00:00:00Z",
         generator: {
            date: "2025-01-17T00:00:00Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2025:14663-1",
         initial_release_date: "2025-01-17T00:00:00Z",
         revision_history: [
            {
               date: "2025-01-17T00:00:00Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                        product: {
                           name: "velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                           product_id: "velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                        product: {
                           name: "velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                           product_id: "velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                        product: {
                           name: "velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                           product_id: "velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
                        product: {
                           name: "velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
                           product_id: "velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "openSUSE Tumbleweed",
                        product: {
                           name: "openSUSE Tumbleweed",
                           product_id: "openSUSE Tumbleweed",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:tumbleweed",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
            },
            product_reference: "velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
            },
            product_reference: "velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "velociraptor-0.7.0.4.git142.862ef23-1.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
            },
            product_reference: "velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            },
            product_reference: "velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2023-1732",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2023-1732",
            },
         ],
         notes: [
            {
               category: "general",
               text: "When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read()  returns an error. In rare deployment cases (error thrown by the Read()  function), this could lead to a predictable shared secret.\n\nThe tkn20 and blindrsa components did not check whether enough randomness was returned from the user provided randomness source. Typically the user provides crypto/rand.Reader, which in the vast majority of cases will always return the right number random bytes. In the cases where it does not, or the user provides a source that does not, the blinding for blindrsa is weak and integrity of the plaintext is not ensured in tkn20.\n\n",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2023-1732",
               url: "https://www.suse.com/security/cve/CVE-2023-1732",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2023-1732",
      },
      {
         cve: "CVE-2023-44270",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2023-44270",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2023-44270",
               url: "https://www.suse.com/security/cve/CVE-2023-44270",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2023-44270",
      },
      {
         cve: "CVE-2023-45133",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2023-45133",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any \"polyfill provider\" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2023-45133",
               url: "https://www.suse.com/security/cve/CVE-2023-45133",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.3,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "critical",
            },
         ],
         title: "CVE-2023-45133",
      },
      {
         cve: "CVE-2023-45683",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2023-45683",
            },
         ],
         notes: [
            {
               category: "general",
               text: "github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting (XSS) in the IdP context during the redirection at the end of a SAML SSO Flow. Consequently, an attacker may perform any authenticated action as the victim once the victim's browser loaded the SAML IdP initiated SSO link for the malicious service provider. Note: SP registration is commonly an unrestricted operation in IdPs, hence not requiring particular permissions or publicly accessible to ease the IdP interoperability. This issue is fixed in version 0.4.14. Users unable to upgrade may perform external validation of URLs provided in SAML metadata, or restrict the ability for end-users to upload arbitrary metadata.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2023-45683",
               url: "https://www.suse.com/security/cve/CVE-2023-45683",
            },
            {
               category: "external",
               summary: "SUSE Bug 1216308 for CVE-2023-45683",
               url: "https://bugzilla.suse.com/1216308",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2023-45683",
      },
      {
         cve: "CVE-2023-46234",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2023-46234",
            },
         ],
         notes: [
            {
               category: "general",
               text: "browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.\n",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2023-46234",
               url: "https://www.suse.com/security/cve/CVE-2023-46234",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2023-46234",
      },
      {
         cve: "CVE-2024-21538",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-21538",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-21538",
               url: "https://www.suse.com/security/cve/CVE-2024-21538",
            },
            {
               category: "external",
               summary: "SUSE Bug 1233843 for CVE-2024-21538",
               url: "https://bugzilla.suse.com/1233843",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-21538",
      },
      {
         cve: "CVE-2024-23331",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-23331",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. This issue has been addressed in vite@5.0.12, vite@4.5.2, vite@3.2.8, and vite@2.9.17. Users are advised to upgrade. Users unable to upgrade should restrict access to dev servers.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-23331",
               url: "https://www.suse.com/security/cve/CVE-2024-23331",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-23331",
      },
      {
         cve: "CVE-2024-24786",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-24786",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-24786",
               url: "https://www.suse.com/security/cve/CVE-2024-24786",
            },
            {
               category: "external",
               summary: "SUSE Bug 1226136 for CVE-2024-24786",
               url: "https://bugzilla.suse.com/1226136",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-24786",
      },
      {
         cve: "CVE-2024-28180",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-28180",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.\n",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-28180",
               url: "https://www.suse.com/security/cve/CVE-2024-28180",
            },
            {
               category: "external",
               summary: "SUSE Bug 1234984 for CVE-2024-28180",
               url: "https://bugzilla.suse.com/1234984",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-28180",
      },
      {
         cve: "CVE-2024-31207",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-31207",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vite (French word for \"quick\", pronounced /vit/, like \"veet\") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-31207",
               url: "https://www.suse.com/security/cve/CVE-2024-31207",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-31207",
      },
      {
         cve: "CVE-2024-37298",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-37298",
            },
         ],
         notes: [
            {
               category: "general",
               text: "gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-37298",
               url: "https://www.suse.com/security/cve/CVE-2024-37298",
            },
            {
               category: "external",
               summary: "SUSE Bug 1227309 for CVE-2024-37298",
               url: "https://bugzilla.suse.com/1227309",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-37298",
      },
      {
         cve: "CVE-2024-4067",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-4067",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-4067",
               url: "https://www.suse.com/security/cve/CVE-2024-4067",
            },
            {
               category: "external",
               summary: "SUSE Bug 1224255 for CVE-2024-4067",
               url: "https://bugzilla.suse.com/1224255",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-4067",
      },
      {
         cve: "CVE-2024-4068",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-4068",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-4068",
               url: "https://www.suse.com/security/cve/CVE-2024-4068",
            },
            {
               category: "external",
               summary: "SUSE Bug 1224256 for CVE-2024-4068",
               url: "https://bugzilla.suse.com/1224256",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-4068",
      },
      {
         cve: "CVE-2024-42459",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-42459",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-42459",
               url: "https://www.suse.com/security/cve/CVE-2024-42459",
            },
            {
               category: "external",
               summary: "SUSE Bug 1232538 for CVE-2024-42459",
               url: "https://bugzilla.suse.com/1232538",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-42459",
      },
      {
         cve: "CVE-2024-42460",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-42460",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-42460",
               url: "https://www.suse.com/security/cve/CVE-2024-42460",
            },
            {
               category: "external",
               summary: "SUSE Bug 1232538 for CVE-2024-42460",
               url: "https://bugzilla.suse.com/1232538",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-42460",
      },
      {
         cve: "CVE-2024-42461",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-42461",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-42461",
               url: "https://www.suse.com/security/cve/CVE-2024-42461",
            },
            {
               category: "external",
               summary: "SUSE Bug 1232538 for CVE-2024-42461",
               url: "https://bugzilla.suse.com/1232538",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-42461",
      },
      {
         cve: "CVE-2024-45296",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-45296",
            },
         ],
         notes: [
            {
               category: "general",
               text: "path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-45296",
               url: "https://www.suse.com/security/cve/CVE-2024-45296",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-45296",
      },
      {
         cve: "CVE-2024-45338",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-45338",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-45338",
               url: "https://www.suse.com/security/cve/CVE-2024-45338",
            },
            {
               category: "external",
               summary: "SUSE Bug 1234794 for CVE-2024-45338",
               url: "https://bugzilla.suse.com/1234794",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-45338",
      },
      {
         cve: "CVE-2024-45811",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-45811",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-45811",
               url: "https://www.suse.com/security/cve/CVE-2024-45811",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-45811",
      },
      {
         cve: "CVE-2024-45812",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-45812",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to `cjs`/`iife`/`umd` output format. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present. DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. We have identified a DOM Clobbering vulnerability in Vite bundled scripts, particularly when the scripts dynamically import other scripts from the assets folder and the developer sets the build output format to `cjs`, `iife`, or `umd`. In such cases, Vite replaces relative paths starting with `__VITE_ASSET__` using the URL retrieved from `document.currentScript`. However, this implementation is vulnerable to a DOM Clobbering attack. The `document.currentScript` lookup can be shadowed by an attacker via the browser's named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the src attribute of the attacker-controlled element is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server. This vulnerability can result in cross-site scripting (XSS) attacks on websites that include Vite-bundled files (configured with an output format of `cjs`, `iife`, or `umd`) and allow users to inject certain scriptless HTML tags without properly sanitizing the name or id attributes. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-45812",
               url: "https://www.suse.com/security/cve/CVE-2024-45812",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-45812",
      },
      {
         cve: "CVE-2024-47068",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-47068",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4  contain a patch for the vulnerability.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-47068",
               url: "https://www.suse.com/security/cve/CVE-2024-47068",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.1,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-47068",
      },
      {
         cve: "CVE-2024-47875",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-47875",
            },
         ],
         notes: [
            {
               category: "general",
               text: "DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-47875",
               url: "https://www.suse.com/security/cve/CVE-2024-47875",
            },
            {
               category: "external",
               summary: "SUSE Bug 1231571 for CVE-2024-47875",
               url: "https://bugzilla.suse.com/1231571",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-47875",
      },
      {
         cve: "CVE-2024-48948",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-48948",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-48948",
               url: "https://www.suse.com/security/cve/CVE-2024-48948",
            },
            {
               category: "external",
               summary: "SUSE Bug 1231681 for CVE-2024-48948",
               url: "https://bugzilla.suse.com/1231681",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.8,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-48948",
      },
      {
         cve: "CVE-2024-48949",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-48949",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits \"sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()\" validation.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-48949",
               url: "https://www.suse.com/security/cve/CVE-2024-48949",
            },
            {
               category: "external",
               summary: "SUSE Bug 1231557 for CVE-2024-48949",
               url: "https://bugzilla.suse.com/1231557",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.2,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-48949",
      },
      {
         cve: "CVE-2024-51744",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-51744",
            },
         ],
         notes: [
            {
               category: "general",
               text: "golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in \"dangerous\" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors (\"dangerous\" ones first), so that you are not running in the case detailed above.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-51744",
               url: "https://www.suse.com/security/cve/CVE-2024-51744",
            },
            {
               category: "external",
               summary: "SUSE Bug 1232936 for CVE-2024-51744",
               url: "https://bugzilla.suse.com/1232936",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 3.1,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "low",
            },
         ],
         title: "CVE-2024-51744",
      },
      {
         cve: "CVE-2024-55565",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-55565",
            },
         ],
         notes: [
            {
               category: "general",
               text: "nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-55565",
               url: "https://www.suse.com/security/cve/CVE-2024-55565",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-55565",
      },
      {
         cve: "CVE-2024-6104",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-6104",
            },
         ],
         notes: [
            {
               category: "general",
               text: "go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
               "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-6104",
               url: "https://www.suse.com/security/cve/CVE-2024-6104",
            },
            {
               category: "external",
               summary: "SUSE Bug 1227024 for CVE-2024-6104",
               url: "https://bugzilla.suse.com/1227024",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.aarch64",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.ppc64le",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.s390x",
                  "openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-17T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-6104",
      },
   ],
}