Vulnerability-Lookup

RHSA-2021_2239

Vulnerability from csaf_redhat - Published: 2021-06-03 10:26 - Updated: 2024-11-22 15:50

Summary

Red Hat Security Advisory: Red Hat Virtualization Host security update [ovirt-4.4.6]

Severity

Moderate

Notes

Topic: An update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. Security Fix(es): * python-cryptography: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25659) * krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS (CVE-2020-28196) * python-cryptography: certain sequences of update() calls when symmetrically encrypting very large payloads could result in an integer overflow and lead to buffer overflows (CVE-2020-36242) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Previously, old RPM files were not properly removed during package removal (uninistall) or upgrade. As a result, removed packages were reinstalled, or, during and upgrade, the system tried to install two or more different versions at once, causing the upgrade to fail. In this release, the dnf plugin has been fixed, and RPM packages are now properly removed. The new version will also auto-heal the broken system by removing RPM packages which are not supposed to be in the persisted-rpms directory. (BZ#1936972) * With this release, ovirt-hosted-engine-ha supports multiple, comma-separated values for all iSCSI configuration items. (BZ#1909888)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2020-25659

A flaw was found in python-cryptography, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows an attacker, via the RSA decryption API, to decrypt parts of the ciphertext encrypted with RSA. The highest threat from this vulnerability is to confidentiality.

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-385 - Covert Timing Channel

Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891 https://access.redhat.com/errata/RHSA-2021:2239

CVE-2020-28196

A flaw was found in krb5. MIT Kerberos 5 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-674 - Uncontrolled Recursion

CVE-2020-36242

A buffer-overflow flaw was found in the python-cryptography package. In certain sequences of ``update()`` calls when symmetrically encrypting very large payloads (>2GB) could result in an integer overflow, leading to buffer overflows. Note: This fix is a workaround for the OpenSSL CVE-2021-23840 flaw. Source: pyca/cryptography project

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

References

URL

Category

	https://access.redhat.com/errata/RHSA-2021:2239	self
	https://access.redhat.com/security/updates/classi…	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1779052	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1882542	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1889988	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1897893	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1901041	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1901878	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1909888	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1926226	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1931443	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1936972	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1938925	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1942580	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1944632	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1946095	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1948944	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1949431	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1957604	external
	https://security.access.redhat.com/data/csaf/v2/a…	self
	https://access.redhat.com/security/cve/CVE-2020-25659	self
	https://bugzilla.redhat.com/show_bug.cgi?id=1889988	external
	https://www.cve.org/CVERecord?id=CVE-2020-25659	external
	https://nvd.nist.gov/vuln/detail/CVE-2020-25659	external
	https://cryptography.io/en/latest/changelog.html#v3-2	external
	https://access.redhat.com/security/cve/CVE-2020-28196	self
	https://bugzilla.redhat.com/show_bug.cgi?id=1901041	external
	https://www.cve.org/CVERecord?id=CVE-2020-28196	external
	https://nvd.nist.gov/vuln/detail/CVE-2020-28196	external
	https://access.redhat.com/security/cve/CVE-2020-36242	self
	https://bugzilla.redhat.com/show_bug.cgi?id=1926226	external
	https://www.cve.org/CVERecord?id=CVE-2020-36242	external
	https://nvd.nist.gov/vuln/detail/CVE-2020-36242	external
	https://cryptography.io/en/latest/changelog.html#v3-3-2	external

Acknowledgments

Red Hat Hubert Kario

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host\u0027s resources and performing administrative tasks.\n\nThe redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host\u0027s resources and performing administrative tasks. \n\nThe ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host\u0027s resources and performing administrative tasks.\n\nSecurity Fix(es):\n\n* python-cryptography: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25659)\n\n* krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS (CVE-2020-28196)\n\n* python-cryptography: certain sequences of update() calls when symmetrically encrypting very large payloads could result in an integer overflow and lead to buffer overflows (CVE-2020-36242)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Previously, old RPM files were not properly removed during package removal (uninistall) or upgrade. As a result, removed packages were reinstalled, or, during and upgrade, the system tried to install two or more different versions at once, causing the upgrade to fail.\nIn this release, the dnf plugin has been fixed, and RPM packages are now properly removed.\nThe new version will also auto-heal the broken system by removing RPM packages which are not supposed to be in the persisted-rpms directory. (BZ#1936972)\n\n* With this release, ovirt-hosted-engine-ha supports multiple, comma-separated values for all iSCSI configuration items. (BZ#1909888)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:2239",
        "url": "https://access.redhat.com/errata/RHSA-2021:2239"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1779052",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1779052"
      },
      {
        "category": "external",
        "summary": "1882542",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1882542"
      },
      {
        "category": "external",
        "summary": "1889988",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889988"
      },
      {
        "category": "external",
        "summary": "1897893",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1897893"
      },
      {
        "category": "external",
        "summary": "1901041",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901041"
      },
      {
        "category": "external",
        "summary": "1901878",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901878"
      },
      {
        "category": "external",
        "summary": "1909888",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909888"
      },
      {
        "category": "external",
        "summary": "1926226",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1926226"
      },
      {
        "category": "external",
        "summary": "1931443",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1931443"
      },
      {
        "category": "external",
        "summary": "1936972",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1936972"
      },
      {
        "category": "external",
        "summary": "1938925",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1938925"
      },
      {
        "category": "external",
        "summary": "1942580",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942580"
      },
      {
        "category": "external",
        "summary": "1944632",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1944632"
      },
      {
        "category": "external",
        "summary": "1946095",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1946095"
      },
      {
        "category": "external",
        "summary": "1948944",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1948944"
      },
      {
        "category": "external",
        "summary": "1949431",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1949431"
      },
      {
        "category": "external",
        "summary": "1957604",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1957604"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2239.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Virtualization Host security update [ovirt-4.4.6]",
    "tracking": {
      "current_release_date": "2024-11-22T15:50:49+00:00",
      "generator": {
        "date": "2024-11-22T15:50:49+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2021:2239",
      "initial_release_date": "2021-06-03T10:26:34+00:00",
      "revision_history": [
        {
          "date": "2021-06-03T10:26:34+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-06-03T10:26:34+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T15:50:49+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
                "product": {
                  "name": "RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
                  "product_id": "8Base-RHV-HypervisorBuild-4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhev_hypervisor:4.4::el8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
                "product": {
                  "name": "Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
                  "product_id": "8Base-RHV-Agents-4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhev_hypervisor:4.4::el8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Virtualization 4 Hypervisor for RHEL 8",
                "product": {
                  "name": "Red Hat Virtualization 4 Hypervisor for RHEL 8",
                  "product_id": "8Base-RHV-Hypervisor-4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhev_hypervisor:4.4::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
                "product": {
                  "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
                  "product_id": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redhat-release-virtualization-host@4.4.6-1.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "imgbased-0:1.2.19-1.el8ev.src",
                "product": {
                  "name": "imgbased-0:1.2.19-1.el8ev.src",
                  "product_id": "imgbased-0:1.2.19-1.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/imgbased@1.2.19-1.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "scap-security-guide-0:0.1.54-1.el8ev.src",
                "product": {
                  "name": "scap-security-guide-0:0.1.54-1.el8ev.src",
                  "product_id": "scap-security-guide-0:0.1.54-1.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/scap-security-guide@0.1.54-1.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-ovirt-0:0.15.0-2.el8ev.src",
                "product": {
                  "name": "cockpit-ovirt-0:0.15.0-2.el8ev.src",
                  "product_id": "cockpit-ovirt-0:0.15.0-2.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cockpit-ovirt@0.15.0-2.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
                "product": {
                  "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
                  "product_id": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-hosted-engine-ha@2.4.7-1.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
                "product": {
                  "name": "redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
                  "product_id": "redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redhat-virtualization-host@4.4.6-20210527.3.el8_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
                "product": {
                  "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
                  "product_id": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redhat-release-virtualization-host@4.4.6-1.el8ev?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-debuginfod-client@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-debugsource-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-debugsource-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-debugsource-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-debugsource@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-debuginfo-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-debuginfo-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-debuginfo-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-debuginfo@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-debuginfod-client-debuginfo@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-debuginfod-debuginfo@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-libelf-debuginfo@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-libs-debuginfo@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64",
                "product": {
                  "name": "redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64",
                  "product_id": "redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redhat-virtualization-host-image-update@4.4.6-20210527.3.el8_4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
                "product": {
                  "name": "redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
                  "product_id": "redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redhat-virtualization-host-image-update-placeholder@4.4.6-1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "imgbased-0:1.2.19-1.el8ev.noarch",
                "product": {
                  "name": "imgbased-0:1.2.19-1.el8ev.noarch",
                  "product_id": "imgbased-0:1.2.19-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/imgbased@1.2.19-1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-imgbased-0:1.2.19-1.el8ev.noarch",
                "product": {
                  "name": "python3-imgbased-0:1.2.19-1.el8ev.noarch",
                  "product_id": "python3-imgbased-0:1.2.19-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-imgbased@1.2.19-1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch",
                "product": {
                  "name": "scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch",
                  "product_id": "scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/scap-security-guide-rhv@0.1.54-1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
                "product": {
                  "name": "cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
                  "product_id": "cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cockpit-ovirt-dashboard@0.15.0-2.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
                "product": {
                  "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
                  "product_id": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-hosted-engine-ha@2.4.7-1.el8ev?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-ovirt-0:0.15.0-2.el8ev.src as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
          "product_id": "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src"
        },
        "product_reference": "cockpit-ovirt-0:0.15.0-2.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-Agents-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
          "product_id": "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch"
        },
        "product_reference": "cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-Agents-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
          "product_id": "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch"
        },
        "product_reference": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-Agents-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
          "product_id": "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src"
        },
        "product_reference": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-Agents-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-debuginfo-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-debuginfo-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-debuginfod-client-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-debugsource-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-debugsource-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-libs-debuginfo-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src"
        },
        "product_reference": "redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
        },
        "product_reference": "redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "imgbased-0:1.2.19-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch"
        },
        "product_reference": "imgbased-0:1.2.19-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "imgbased-0:1.2.19-1.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src"
        },
        "product_reference": "imgbased-0:1.2.19-1.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-imgbased-0:1.2.19-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch"
        },
        "product_reference": "python3-imgbased-0:1.2.19-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src"
        },
        "product_reference": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64 as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64"
        },
        "product_reference": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch"
        },
        "product_reference": "redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "scap-security-guide-0:0.1.54-1.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src"
        },
        "product_reference": "scap-security-guide-0:0.1.54-1.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
        },
        "product_reference": "scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Hubert Kario"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2020-25659",
      "cwe": {
        "id": "CWE-385",
        "name": "Covert Timing Channel"
      },
      "discovery_date": "2020-10-21T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
            "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
            "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1889988"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in python-cryptography, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows an attacker, via the RSA decryption API, to decrypt parts of the ciphertext encrypted with RSA. The highest threat from this vulnerability is to confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-cryptography package.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
        ],
        "known_not_affected": [
          "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
          "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
          "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-25659"
        },
        {
          "category": "external",
          "summary": "RHBZ#1889988",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889988"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-25659",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-25659"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-25659",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25659"
        },
        {
          "category": "external",
          "summary": "https://cryptography.io/en/latest/changelog.html#v3-2",
          "url": "https://cryptography.io/en/latest/changelog.html#v3-2"
        }
      ],
      "release_date": "2020-10-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-03T10:26:34+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891",
          "product_ids": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2239"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption"
    },
    {
      "cve": "CVE-2020-28196",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "discovery_date": "2020-11-06T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
            "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
            "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1901041"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in krb5. MIT Kerberos 5 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
        ],
        "known_not_affected": [
          "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
          "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
          "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-28196"
        },
        {
          "category": "external",
          "summary": "RHBZ#1901041",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901041"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-28196",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-28196"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-28196",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28196"
        }
      ],
      "release_date": "2020-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-03T10:26:34+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891",
          "product_ids": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2239"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS"
    },
    {
      "cve": "CVE-2020-36242",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2021-02-07T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
            "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
            "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1926226"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer-overflow flaw was found in the python-cryptography package. In certain sequences of ``update()`` calls when symmetrically encrypting very large payloads (\u003e2GB) could result in an integer overflow, leading to buffer overflows. Note: This fix is a workaround for the OpenSSL CVE-2021-23840 flaw. Source: pyca/cryptography project",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Triggering this flaw on in versions of python-cryptography as shipped with Red Hat Enterprise Linux 8 BaseOS, Appstream, as well as Red Hat Software Collections, can result in denial of service due to memory consumption or MemoryError exception.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-cryptography package.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
        ],
        "known_not_affected": [
          "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
          "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
          "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-36242"
        },
        {
          "category": "external",
          "summary": "RHBZ#1926226",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1926226"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-36242",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-36242"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-36242",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36242"
        },
        {
          "category": "external",
          "summary": "https://cryptography.io/en/latest/changelog.html#v3-3-2",
          "url": "https://cryptography.io/en/latest/changelog.html#v3-3-2"
        }
      ],
      "release_date": "2020-12-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-03T10:26:34+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891",
          "product_ids": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2239"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
            "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
            "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow"
    }
  ]
}

CVE-2020-25659 (GCVE-0-2020-25659)

Vulnerability from cvelistv5 – Published: 2021-01-11 15:37 – Updated: 2024-08-04 15:40

Summary

python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

Severity ?

No CVSS data available.

CWE

CWE-385

Assigner

redhat

References

URL

Tags

	https://github.com/pyca/cryptography/pull/5507/co…	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	python-cryptography	Affected: python-cryptography 3.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:40:36.578Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "python-cryptography",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "python-cryptography 3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-385",
              "description": "CWE-385",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:15:44.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2020-25659",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "python-cryptography",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "python-cryptography 3.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-385"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b",
              "refsource": "MISC",
              "url": "https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-25659",
    "datePublished": "2021-01-11T15:37:29.000Z",
    "dateReserved": "2020-09-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T15:40:36.578Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-28196 (GCVE-0-2020-28196)

Vulnerability from cvelistv5 – Published: 2020-11-06 07:07 – Updated: 2025-12-03 18:15

Summary

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

Assigner

mitre

References

URL

Tags

	https://lists.debian.org/debian-lts-announce/2020…	mailing-listx_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://security.gentoo.org/glsa/202011-17	vendor-advisoryx_refsource_GENTOO
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://www.debian.org/security/2020/dsa-4795	vendor-advisoryx_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-2021051…	x_refsource_CONFIRM
	https://github.com/krb5/krb5/commit/57415dda6cf04…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020120…	x_refsource_CONFIRM
	https://lists.apache.org/thread.html/rf4c02775860…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r58af02e294b…	mailing-listx_refsource_MLIST
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:33:58.154Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20201107 [SECURITY] [DLA 2437-1] krb5 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html"
          },
          {
            "name": "FEDORA-2020-32193cbbe6",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/"
          },
          {
            "name": "FEDORA-2020-27b577ab23",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/"
          },
          {
            "name": "GLSA-202011-17",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202011-17"
          },
          {
            "name": "FEDORA-2020-0df38b2843",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/"
          },
          {
            "name": "DSA-4795",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4795"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201202-0001/"
          },
          {
            "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
          },
          {
            "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-28196",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-03T18:14:50.101539Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-674",
                "description": "CWE-674 Uncontrolled Recursion",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-03T18:15:34.180Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-19T23:22:37.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20201107 [SECURITY] [DLA 2437-1] krb5 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html"
        },
        {
          "name": "FEDORA-2020-32193cbbe6",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/"
        },
        {
          "name": "FEDORA-2020-27b577ab23",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/"
        },
        {
          "name": "GLSA-202011-17",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202011-17"
        },
        {
          "name": "FEDORA-2020-0df38b2843",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/"
        },
        {
          "name": "DSA-4795",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4795"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201202-0001/"
        },
        {
          "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
        },
        {
          "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-28196",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20201107 [SECURITY] [DLA 2437-1] krb5 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html"
            },
            {
              "name": "FEDORA-2020-32193cbbe6",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/"
            },
            {
              "name": "FEDORA-2020-27b577ab23",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/"
            },
            {
              "name": "GLSA-202011-17",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202011-17"
            },
            {
              "name": "FEDORA-2020-0df38b2843",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/"
            },
            {
              "name": "DSA-4795",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4795"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210513-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
            },
            {
              "name": "https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201202-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201202-0001/"
            },
            {
              "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"
            },
            {
              "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-28196",
    "datePublished": "2020-11-06T07:07:38.000Z",
    "dateReserved": "2020-11-03T00:00:00.000Z",
    "dateUpdated": "2025-12-03T18:15:34.180Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2020-36242 (GCVE-0-2020-36242)

Vulnerability from cvelistv5 – Published: 2021-02-07 19:50 – Updated: 2024-08-04 17:23

Summary

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://github.com/pyca/cryptography/issues/5615	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://github.com/pyca/cryptography/compare/3.3.…	x_refsource_CONFIRM
	https://github.com/pyca/cryptography/blob/master/…	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:23:09.814Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pyca/cryptography/issues/5615"
          },
          {
            "name": "FEDORA-2021-8e36e7ed1a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/pyca/cryptography/compare/3.3.1...3.3.2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:22:24.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyca/cryptography/issues/5615"
        },
        {
          "name": "FEDORA-2021-8e36e7ed1a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pyca/cryptography/compare/3.3.1...3.3.2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-36242",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/pyca/cryptography/issues/5615",
              "refsource": "MISC",
              "url": "https://github.com/pyca/cryptography/issues/5615"
            },
            {
              "name": "FEDORA-2021-8e36e7ed1a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://github.com/pyca/cryptography/compare/3.3.1...3.3.2",
              "refsource": "CONFIRM",
              "url": "https://github.com/pyca/cryptography/compare/3.3.1...3.3.2"
            },
            {
              "name": "https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst",
              "refsource": "CONFIRM",
              "url": "https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-36242",
    "datePublished": "2021-02-07T19:50:57.000Z",
    "dateReserved": "2021-02-07T00:00:00.000Z",
    "dateUpdated": "2024-08-04T17:23:09.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2021_2239

CVE-2020-25659 (GCVE-0-2020-25659)

CVE-2020-28196 (GCVE-0-2020-28196)

CVE-2020-36242 (GCVE-0-2020-36242)

Tags

Sightings

Nomenclature