csaf_redhat - rhsa-2023

rhsa-2023_4889

Vulnerability from csaf_redhat

Published

2023-08-30 21:20

Modified

2024-12-01 15:28

Summary

Red Hat Security Advisory: DevWorkspace Operator 0.22 release

Notes

Topic

Red Hat DevWorkspace Operator 0.22 has been released. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

The DevWorkspace Operator extends OpenShift to provide DevWorkspace support. Security Fix(es): * openssh: Remote code execution in ssh-agent PKCS#11 support (CVE-2023-38408) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat DevWorkspace Operator 0.22 has been released.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The DevWorkspace Operator extends OpenShift to provide DevWorkspace support.\n\nSecurity Fix(es):\n\n* openssh: Remote code execution in ssh-agent PKCS#11 support (CVE-2023-38408)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:4889",
        "url": "https://access.redhat.com/errata/RHSA-2023:4889"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2224173",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224173"
      },
      {
        "category": "external",
        "summary": "CRW-4641",
        "url": "https://issues.redhat.com/browse/CRW-4641"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4889.json"
      }
    ],
    "title": "Red Hat Security Advisory: DevWorkspace Operator 0.22 release",
    "tracking": {
      "current_release_date": "2024-12-01T15:28:42+00:00",
      "generator": {
        "date": "2024-12-01T15:28:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2023:4889",
      "initial_release_date": "2023-08-30T21:20:44+00:00",
      "revision_history": [
        {
          "date": "2023-08-30T21:20:44+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-08-30T21:20:44+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-01T15:28:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Devworkspace 1.0 for RHEL 8",
                "product": {
                  "name": "Devworkspace 1.0 for RHEL 8",
                  "product_id": "8Base-DEVWORKSPACE-1.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:devworkspace:1.0::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "DEVWORKSPACE"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "devworkspace/devworkspace-operator-bundle@sha256:d97da395e5370ddfc6bed0a36b0bf4e8923fdc7b281541619a2244554bc22fc5_ppc64le",
                "product": {
                  "name": "devworkspace/devworkspace-operator-bundle@sha256:d97da395e5370ddfc6bed0a36b0bf4e8923fdc7b281541619a2244554bc22fc5_ppc64le",
                  "product_id": "devworkspace/devworkspace-operator-bundle@sha256:d97da395e5370ddfc6bed0a36b0bf4e8923fdc7b281541619a2244554bc22fc5_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-operator-bundle@sha256:d97da395e5370ddfc6bed0a36b0bf4e8923fdc7b281541619a2244554bc22fc5?arch=ppc64le\u0026repository_url=registry.redhat.io/devworkspace/devworkspace-operator-bundle\u0026tag=0.22-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "devworkspace/devworkspace-rhel8-operator@sha256:2079028c1f40b18bb0b8fdc6f334a54bc15b7487088ca04623a7ef98ef36d9be_ppc64le",
                "product": {
                  "name": "devworkspace/devworkspace-rhel8-operator@sha256:2079028c1f40b18bb0b8fdc6f334a54bc15b7487088ca04623a7ef98ef36d9be_ppc64le",
                  "product_id": "devworkspace/devworkspace-rhel8-operator@sha256:2079028c1f40b18bb0b8fdc6f334a54bc15b7487088ca04623a7ef98ef36d9be_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-rhel8-operator@sha256:2079028c1f40b18bb0b8fdc6f334a54bc15b7487088ca04623a7ef98ef36d9be?arch=ppc64le\u0026repository_url=registry.redhat.io/devworkspace/devworkspace-rhel8-operator\u0026tag=0.22-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "devworkspace/devworkspace-project-clone-rhel8@sha256:17e535028dea4aeeb6d6709a2fe3abfbc1d2f33709d7e9e216c9e58b5f519a91_ppc64le",
                "product": {
                  "name": "devworkspace/devworkspace-project-clone-rhel8@sha256:17e535028dea4aeeb6d6709a2fe3abfbc1d2f33709d7e9e216c9e58b5f519a91_ppc64le",
                  "product_id": "devworkspace/devworkspace-project-clone-rhel8@sha256:17e535028dea4aeeb6d6709a2fe3abfbc1d2f33709d7e9e216c9e58b5f519a91_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-project-clone-rhel8@sha256:17e535028dea4aeeb6d6709a2fe3abfbc1d2f33709d7e9e216c9e58b5f519a91?arch=ppc64le\u0026repository_url=registry.redhat.io/devworkspace/devworkspace-project-clone-rhel8\u0026tag=0.22-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "devworkspace/devworkspace-operator-bundle@sha256:a185d4573a72c5f4bf0847aa17b6c8efdcc63ce7c4f936018b57c5a024ecf971_amd64",
                "product": {
                  "name": "devworkspace/devworkspace-operator-bundle@sha256:a185d4573a72c5f4bf0847aa17b6c8efdcc63ce7c4f936018b57c5a024ecf971_amd64",
                  "product_id": "devworkspace/devworkspace-operator-bundle@sha256:a185d4573a72c5f4bf0847aa17b6c8efdcc63ce7c4f936018b57c5a024ecf971_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-operator-bundle@sha256:a185d4573a72c5f4bf0847aa17b6c8efdcc63ce7c4f936018b57c5a024ecf971?arch=amd64\u0026repository_url=registry.redhat.io/devworkspace/devworkspace-operator-bundle\u0026tag=0.22-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "devworkspace/devworkspace-rhel8-operator@sha256:eef32cc05cbfa99bdf7b98a0ca7c53c6412b347a5984e2c4564fa26cefaec471_amd64",
                "product": {
                  "name": "devworkspace/devworkspace-rhel8-operator@sha256:eef32cc05cbfa99bdf7b98a0ca7c53c6412b347a5984e2c4564fa26cefaec471_amd64",
                  "product_id": "devworkspace/devworkspace-rhel8-operator@sha256:eef32cc05cbfa99bdf7b98a0ca7c53c6412b347a5984e2c4564fa26cefaec471_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-rhel8-operator@sha256:eef32cc05cbfa99bdf7b98a0ca7c53c6412b347a5984e2c4564fa26cefaec471?arch=amd64\u0026repository_url=registry.redhat.io/devworkspace/devworkspace-rhel8-operator\u0026tag=0.22-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "devworkspace/devworkspace-project-clone-rhel8@sha256:042ee6de1b850b0fc3f656158c0c0d34d8ba83b5715c8e0eeb71855085fcbe4a_amd64",
                "product": {
                  "name": "devworkspace/devworkspace-project-clone-rhel8@sha256:042ee6de1b850b0fc3f656158c0c0d34d8ba83b5715c8e0eeb71855085fcbe4a_amd64",
                  "product_id": "devworkspace/devworkspace-project-clone-rhel8@sha256:042ee6de1b850b0fc3f656158c0c0d34d8ba83b5715c8e0eeb71855085fcbe4a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-project-clone-rhel8@sha256:042ee6de1b850b0fc3f656158c0c0d34d8ba83b5715c8e0eeb71855085fcbe4a?arch=amd64\u0026repository_url=registry.redhat.io/devworkspace/devworkspace-project-clone-rhel8\u0026tag=0.22-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "devworkspace/devworkspace-operator-bundle@sha256:c0944468eec87646b3d7702577393e0bde343f892e6abc3202d46e5a3049341d_s390x",
                "product": {
                  "name": "devworkspace/devworkspace-operator-bundle@sha256:c0944468eec87646b3d7702577393e0bde343f892e6abc3202d46e5a3049341d_s390x",
                  "product_id": "devworkspace/devworkspace-operator-bundle@sha256:c0944468eec87646b3d7702577393e0bde343f892e6abc3202d46e5a3049341d_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-operator-bundle@sha256:c0944468eec87646b3d7702577393e0bde343f892e6abc3202d46e5a3049341d?arch=s390x\u0026repository_url=registry.redhat.io/devworkspace/devworkspace-operator-bundle\u0026tag=0.22-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "devworkspace/devworkspace-rhel8-operator@sha256:2965b996432749b212d7a0437ac29450096fb00bff0a8e90c879da38e91a9a0c_s390x",
                "product": {
                  "name": "devworkspace/devworkspace-rhel8-operator@sha256:2965b996432749b212d7a0437ac29450096fb00bff0a8e90c879da38e91a9a0c_s390x",
                  "product_id": "devworkspace/devworkspace-rhel8-operator@sha256:2965b996432749b212d7a0437ac29450096fb00bff0a8e90c879da38e91a9a0c_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-rhel8-operator@sha256:2965b996432749b212d7a0437ac29450096fb00bff0a8e90c879da38e91a9a0c?arch=s390x\u0026repository_url=registry.redhat.io/devworkspace/devworkspace-rhel8-operator\u0026tag=0.22-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "devworkspace/devworkspace-project-clone-rhel8@sha256:0a602da178432c733b3163c4be21f153ff57971247c13e144f48fb2df4522a5b_s390x",
                "product": {
                  "name": "devworkspace/devworkspace-project-clone-rhel8@sha256:0a602da178432c733b3163c4be21f153ff57971247c13e144f48fb2df4522a5b_s390x",
                  "product_id": "devworkspace/devworkspace-project-clone-rhel8@sha256:0a602da178432c733b3163c4be21f153ff57971247c13e144f48fb2df4522a5b_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-project-clone-rhel8@sha256:0a602da178432c733b3163c4be21f153ff57971247c13e144f48fb2df4522a5b?arch=s390x\u0026repository_url=registry.redhat.io/devworkspace/devworkspace-project-clone-rhel8\u0026tag=0.22-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devworkspace/devworkspace-operator-bundle@sha256:a185d4573a72c5f4bf0847aa17b6c8efdcc63ce7c4f936018b57c5a024ecf971_amd64 as a component of Devworkspace 1.0 for RHEL 8",
          "product_id": "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-operator-bundle@sha256:a185d4573a72c5f4bf0847aa17b6c8efdcc63ce7c4f936018b57c5a024ecf971_amd64"
        },
        "product_reference": "devworkspace/devworkspace-operator-bundle@sha256:a185d4573a72c5f4bf0847aa17b6c8efdcc63ce7c4f936018b57c5a024ecf971_amd64",
        "relates_to_product_reference": "8Base-DEVWORKSPACE-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devworkspace/devworkspace-operator-bundle@sha256:c0944468eec87646b3d7702577393e0bde343f892e6abc3202d46e5a3049341d_s390x as a component of Devworkspace 1.0 for RHEL 8",
          "product_id": "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-operator-bundle@sha256:c0944468eec87646b3d7702577393e0bde343f892e6abc3202d46e5a3049341d_s390x"
        },
        "product_reference": "devworkspace/devworkspace-operator-bundle@sha256:c0944468eec87646b3d7702577393e0bde343f892e6abc3202d46e5a3049341d_s390x",
        "relates_to_product_reference": "8Base-DEVWORKSPACE-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devworkspace/devworkspace-operator-bundle@sha256:d97da395e5370ddfc6bed0a36b0bf4e8923fdc7b281541619a2244554bc22fc5_ppc64le as a component of Devworkspace 1.0 for RHEL 8",
          "product_id": "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-operator-bundle@sha256:d97da395e5370ddfc6bed0a36b0bf4e8923fdc7b281541619a2244554bc22fc5_ppc64le"
        },
        "product_reference": "devworkspace/devworkspace-operator-bundle@sha256:d97da395e5370ddfc6bed0a36b0bf4e8923fdc7b281541619a2244554bc22fc5_ppc64le",
        "relates_to_product_reference": "8Base-DEVWORKSPACE-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devworkspace/devworkspace-project-clone-rhel8@sha256:042ee6de1b850b0fc3f656158c0c0d34d8ba83b5715c8e0eeb71855085fcbe4a_amd64 as a component of Devworkspace 1.0 for RHEL 8",
          "product_id": "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-project-clone-rhel8@sha256:042ee6de1b850b0fc3f656158c0c0d34d8ba83b5715c8e0eeb71855085fcbe4a_amd64"
        },
        "product_reference": "devworkspace/devworkspace-project-clone-rhel8@sha256:042ee6de1b850b0fc3f656158c0c0d34d8ba83b5715c8e0eeb71855085fcbe4a_amd64",
        "relates_to_product_reference": "8Base-DEVWORKSPACE-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devworkspace/devworkspace-project-clone-rhel8@sha256:0a602da178432c733b3163c4be21f153ff57971247c13e144f48fb2df4522a5b_s390x as a component of Devworkspace 1.0 for RHEL 8",
          "product_id": "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-project-clone-rhel8@sha256:0a602da178432c733b3163c4be21f153ff57971247c13e144f48fb2df4522a5b_s390x"
        },
        "product_reference": "devworkspace/devworkspace-project-clone-rhel8@sha256:0a602da178432c733b3163c4be21f153ff57971247c13e144f48fb2df4522a5b_s390x",
        "relates_to_product_reference": "8Base-DEVWORKSPACE-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devworkspace/devworkspace-project-clone-rhel8@sha256:17e535028dea4aeeb6d6709a2fe3abfbc1d2f33709d7e9e216c9e58b5f519a91_ppc64le as a component of Devworkspace 1.0 for RHEL 8",
          "product_id": "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-project-clone-rhel8@sha256:17e535028dea4aeeb6d6709a2fe3abfbc1d2f33709d7e9e216c9e58b5f519a91_ppc64le"
        },
        "product_reference": "devworkspace/devworkspace-project-clone-rhel8@sha256:17e535028dea4aeeb6d6709a2fe3abfbc1d2f33709d7e9e216c9e58b5f519a91_ppc64le",
        "relates_to_product_reference": "8Base-DEVWORKSPACE-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devworkspace/devworkspace-rhel8-operator@sha256:2079028c1f40b18bb0b8fdc6f334a54bc15b7487088ca04623a7ef98ef36d9be_ppc64le as a component of Devworkspace 1.0 for RHEL 8",
          "product_id": "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-rhel8-operator@sha256:2079028c1f40b18bb0b8fdc6f334a54bc15b7487088ca04623a7ef98ef36d9be_ppc64le"
        },
        "product_reference": "devworkspace/devworkspace-rhel8-operator@sha256:2079028c1f40b18bb0b8fdc6f334a54bc15b7487088ca04623a7ef98ef36d9be_ppc64le",
        "relates_to_product_reference": "8Base-DEVWORKSPACE-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devworkspace/devworkspace-rhel8-operator@sha256:2965b996432749b212d7a0437ac29450096fb00bff0a8e90c879da38e91a9a0c_s390x as a component of Devworkspace 1.0 for RHEL 8",
          "product_id": "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-rhel8-operator@sha256:2965b996432749b212d7a0437ac29450096fb00bff0a8e90c879da38e91a9a0c_s390x"
        },
        "product_reference": "devworkspace/devworkspace-rhel8-operator@sha256:2965b996432749b212d7a0437ac29450096fb00bff0a8e90c879da38e91a9a0c_s390x",
        "relates_to_product_reference": "8Base-DEVWORKSPACE-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devworkspace/devworkspace-rhel8-operator@sha256:eef32cc05cbfa99bdf7b98a0ca7c53c6412b347a5984e2c4564fa26cefaec471_amd64 as a component of Devworkspace 1.0 for RHEL 8",
          "product_id": "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-rhel8-operator@sha256:eef32cc05cbfa99bdf7b98a0ca7c53c6412b347a5984e2c4564fa26cefaec471_amd64"
        },
        "product_reference": "devworkspace/devworkspace-rhel8-operator@sha256:eef32cc05cbfa99bdf7b98a0ca7c53c6412b347a5984e2c4564fa26cefaec471_amd64",
        "relates_to_product_reference": "8Base-DEVWORKSPACE-1.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-38408",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2023-07-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2224173"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system (the code in /usr/lib is not necessarily safe for loading into ssh-agent). This flaw allows an attacker with control of the forwarded agent-socket on the server and the ability to write to the filesystem of the client host to execute arbitrary code with the privileges of the user running the ssh-agent.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: Remote code execution in ssh-agent PKCS#11 support",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is marked as Important as we successfully identified that it can do a Remote Code Execution atleast at some circumstances in Red Hat Enterprise Linux 6, 7, 8 and 9 and It can easily compromise the confidentiality, integrity or availability of resources.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-operator-bundle@sha256:a185d4573a72c5f4bf0847aa17b6c8efdcc63ce7c4f936018b57c5a024ecf971_amd64",
          "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-operator-bundle@sha256:c0944468eec87646b3d7702577393e0bde343f892e6abc3202d46e5a3049341d_s390x",
          "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-operator-bundle@sha256:d97da395e5370ddfc6bed0a36b0bf4e8923fdc7b281541619a2244554bc22fc5_ppc64le",
          "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-project-clone-rhel8@sha256:042ee6de1b850b0fc3f656158c0c0d34d8ba83b5715c8e0eeb71855085fcbe4a_amd64",
          "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-project-clone-rhel8@sha256:0a602da178432c733b3163c4be21f153ff57971247c13e144f48fb2df4522a5b_s390x",
          "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-project-clone-rhel8@sha256:17e535028dea4aeeb6d6709a2fe3abfbc1d2f33709d7e9e216c9e58b5f519a91_ppc64le",
          "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-rhel8-operator@sha256:2079028c1f40b18bb0b8fdc6f334a54bc15b7487088ca04623a7ef98ef36d9be_ppc64le",
          "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-rhel8-operator@sha256:2965b996432749b212d7a0437ac29450096fb00bff0a8e90c879da38e91a9a0c_s390x",
          "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-rhel8-operator@sha256:eef32cc05cbfa99bdf7b98a0ca7c53c6412b347a5984e2c4564fa26cefaec471_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-38408"
        },
        {
          "category": "external",
          "summary": "RHBZ#2224173",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224173"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-38408",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-38408"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-38408",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38408"
        },
        {
          "category": "external",
          "summary": "https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt",
          "url": "https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt"
        }
      ],
      "release_date": "2023-07-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-08-30T21:20:44+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-operator-bundle@sha256:a185d4573a72c5f4bf0847aa17b6c8efdcc63ce7c4f936018b57c5a024ecf971_amd64",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-operator-bundle@sha256:c0944468eec87646b3d7702577393e0bde343f892e6abc3202d46e5a3049341d_s390x",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-operator-bundle@sha256:d97da395e5370ddfc6bed0a36b0bf4e8923fdc7b281541619a2244554bc22fc5_ppc64le",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-project-clone-rhel8@sha256:042ee6de1b850b0fc3f656158c0c0d34d8ba83b5715c8e0eeb71855085fcbe4a_amd64",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-project-clone-rhel8@sha256:0a602da178432c733b3163c4be21f153ff57971247c13e144f48fb2df4522a5b_s390x",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-project-clone-rhel8@sha256:17e535028dea4aeeb6d6709a2fe3abfbc1d2f33709d7e9e216c9e58b5f519a91_ppc64le",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-rhel8-operator@sha256:2079028c1f40b18bb0b8fdc6f334a54bc15b7487088ca04623a7ef98ef36d9be_ppc64le",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-rhel8-operator@sha256:2965b996432749b212d7a0437ac29450096fb00bff0a8e90c879da38e91a9a0c_s390x",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-rhel8-operator@sha256:eef32cc05cbfa99bdf7b98a0ca7c53c6412b347a5984e2c4564fa26cefaec471_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:4889"
        },
        {
          "category": "workaround",
          "details": "Remote exploitation required that a user establishes an SSH connection to a compromised or malicious SSH server with agent forwarding enabled.  The agent forwarding is disabled by default.  Review your ssh client configuration files for the use of ForwardAgent configuration directive and invocations of ssh client for the use of -A command line argument to see if agent forwarding is enabled for specific connections.\n\nExploitation can also be prevented by starting ssh-agent(1) with an empty PKCS#11/FIDO allowlist (ssh-agent -P \u0027\u0027) or by configuring an allowlist that contains only specific provider libraries.",
          "product_ids": [
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-operator-bundle@sha256:a185d4573a72c5f4bf0847aa17b6c8efdcc63ce7c4f936018b57c5a024ecf971_amd64",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-operator-bundle@sha256:c0944468eec87646b3d7702577393e0bde343f892e6abc3202d46e5a3049341d_s390x",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-operator-bundle@sha256:d97da395e5370ddfc6bed0a36b0bf4e8923fdc7b281541619a2244554bc22fc5_ppc64le",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-project-clone-rhel8@sha256:042ee6de1b850b0fc3f656158c0c0d34d8ba83b5715c8e0eeb71855085fcbe4a_amd64",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-project-clone-rhel8@sha256:0a602da178432c733b3163c4be21f153ff57971247c13e144f48fb2df4522a5b_s390x",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-project-clone-rhel8@sha256:17e535028dea4aeeb6d6709a2fe3abfbc1d2f33709d7e9e216c9e58b5f519a91_ppc64le",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-rhel8-operator@sha256:2079028c1f40b18bb0b8fdc6f334a54bc15b7487088ca04623a7ef98ef36d9be_ppc64le",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-rhel8-operator@sha256:2965b996432749b212d7a0437ac29450096fb00bff0a8e90c879da38e91a9a0c_s390x",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-rhel8-operator@sha256:eef32cc05cbfa99bdf7b98a0ca7c53c6412b347a5984e2c4564fa26cefaec471_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-operator-bundle@sha256:a185d4573a72c5f4bf0847aa17b6c8efdcc63ce7c4f936018b57c5a024ecf971_amd64",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-operator-bundle@sha256:c0944468eec87646b3d7702577393e0bde343f892e6abc3202d46e5a3049341d_s390x",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-operator-bundle@sha256:d97da395e5370ddfc6bed0a36b0bf4e8923fdc7b281541619a2244554bc22fc5_ppc64le",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-project-clone-rhel8@sha256:042ee6de1b850b0fc3f656158c0c0d34d8ba83b5715c8e0eeb71855085fcbe4a_amd64",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-project-clone-rhel8@sha256:0a602da178432c733b3163c4be21f153ff57971247c13e144f48fb2df4522a5b_s390x",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-project-clone-rhel8@sha256:17e535028dea4aeeb6d6709a2fe3abfbc1d2f33709d7e9e216c9e58b5f519a91_ppc64le",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-rhel8-operator@sha256:2079028c1f40b18bb0b8fdc6f334a54bc15b7487088ca04623a7ef98ef36d9be_ppc64le",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-rhel8-operator@sha256:2965b996432749b212d7a0437ac29450096fb00bff0a8e90c879da38e91a9a0c_s390x",
            "8Base-DEVWORKSPACE-1.0:devworkspace/devworkspace-rhel8-operator@sha256:eef32cc05cbfa99bdf7b98a0ca7c53c6412b347a5984e2c4564fa26cefaec471_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssh: Remote code execution in ssh-agent PKCS#11 support"
    }
  ]
}

cve-2023-38408

Vulnerability from cvelistv5

Published

2023-07-20 00:00

Modified

2024-10-15 18:33

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

References

▼	URL	Tags
	https://news.ycombinator.com/item?id=36790196
	https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent
	https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt
	https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca
	https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8
	https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d
	https://www.openssh.com/txt/release-9.3p2
	https://www.openssh.com/security.html
	https://security.gentoo.org/glsa/202307-01	vendor-advisory
	http://www.openwall.com/lists/oss-security/2023/07/20/1	mailing-list
	http://www.openwall.com/lists/oss-security/2023/07/20/2	mailing-list
	http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20230803-0010/
	https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html	mailing-list
	http://www.openwall.com/lists/oss-security/2023/09/22/9	mailing-list
	http://www.openwall.com/lists/oss-security/2023/09/22/11	mailing-list
	https://support.apple.com/kb/HT213940
	https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:39:13.525Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://news.ycombinator.com/item?id=36790196"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openssh.com/txt/release-9.3p2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openssh.com/security.html"
          },
          {
            "name": "GLSA-202307-01",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202307-01"
          },
          {
            "name": "[oss-security] 20230719 Re: CVE-2023-38408: Remote Code Execution in OpenSSH\u0027s forwarded ssh-agent",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/07/20/1"
          },
          {
            "name": "[oss-security] 20230720 Re: Announce: OpenSSH 9.3p2 released",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/07/20/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html"
          },
          {
            "name": "FEDORA-2023-878e04f4ae",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/"
          },
          {
            "name": "FEDORA-2023-79a18e1725",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230803-0010/"
          },
          {
            "name": "[debian-lts-announce] 20230817 [SECURITY] [DLA 3532-1] openssh security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html"
          },
          {
            "name": "[oss-security] 20230922 Re: illumos (or at least danmcd) membership in the distros list",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/09/22/9"
          },
          {
            "name": "[oss-security] 20230922 Re: illumos (or at least danmcd) membership in the distros list",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/09/22/11"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT213940"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-38408",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T17:36:21.400489Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-428",
                "description": "CWE-428 Unquoted Search Path or Element",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T18:33:21.591Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-04T05:50:59.479313",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://news.ycombinator.com/item?id=36790196"
        },
        {
          "url": "https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent"
        },
        {
          "url": "https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt"
        },
        {
          "url": "https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca"
        },
        {
          "url": "https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8"
        },
        {
          "url": "https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d"
        },
        {
          "url": "https://www.openssh.com/txt/release-9.3p2"
        },
        {
          "url": "https://www.openssh.com/security.html"
        },
        {
          "name": "GLSA-202307-01",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202307-01"
        },
        {
          "name": "[oss-security] 20230719 Re: CVE-2023-38408: Remote Code Execution in OpenSSH\u0027s forwarded ssh-agent",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/07/20/1"
        },
        {
          "name": "[oss-security] 20230720 Re: Announce: OpenSSH 9.3p2 released",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/07/20/2"
        },
        {
          "url": "http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html"
        },
        {
          "name": "FEDORA-2023-878e04f4ae",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/"
        },
        {
          "name": "FEDORA-2023-79a18e1725",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230803-0010/"
        },
        {
          "name": "[debian-lts-announce] 20230817 [SECURITY] [DLA 3532-1] openssh security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html"
        },
        {
          "name": "[oss-security] 20230922 Re: illumos (or at least danmcd) membership in the distros list",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/09/22/9"
        },
        {
          "name": "[oss-security] 20230922 Re: illumos (or at least danmcd) membership in the distros list",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/09/22/11"
        },
        {
          "url": "https://support.apple.com/kb/HT213940"
        },
        {
          "url": "https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-38408",
    "datePublished": "2023-07-20T00:00:00",
    "dateReserved": "2023-07-17T00:00:00",
    "dateUpdated": "2024-10-15T18:33:21.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted